Unusual Process Resolving AWS ECS Agent Communication Service Endpoint

InformationalSplunk security content

Windows Crowdstrike RTR Script Execution

Detects usage of Crowdstrike Real Time Response (RTR) to execute a "runscript" command. This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.

T1059.001

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Sep 30, 2026

InformationalSplunk security content

O365 Email Send Attachments Excessive Volume

The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.

T1070.008T1485

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Sep 30, 2026

InformationalSplunk security content

O365 Email Send and Hard Delete Exfiltration Behavior

The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner.

T1070.008T1114.001T1485

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Sep 30, 2026

InformationalSplunk security content

O365 Email Receive and Hard Delete Takeover Behavior

The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.

T1070.008T1114.001T1485

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Sep 30, 2026

MediumSplunk security content

O365 Email Password and Payroll Compromise Behavior

The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.

T1070.008T1114.001T1485

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Sep 30, 2026

LowMicrosoft Sentinel analytics

Suspicious application consent for offline access

This will alert when a user consents to provide a previously-unknown Azure application with offline access via OAuth. Offline access will provide the Azure App with access to the listed resources without requiring two-factor authentication. Consent to applications with offline access and read capabilities should be rare, especially as the knownApplications list is expanded. Public contributions to expand this filter are welcome! For further information on AuditLogs please see https://docs.

T1528

Licence: MIT License
Published: Sep 30, 2026

HighMicrosoft Sentinel analytics

Conditional Access - Dynamic Group Exclusion Changes

// Detects changes to Dynamic Membership Rules for specified groups (often used in CA exclusions)

T1484

Licence: MIT License
Published: Sep 30, 2026

InformationalMicrosoft Sentinel analytics

Conditional Access - A new Conditional Access policy was created

A new Conditional Access policy was created in Entra ID.

T1562.007

Licence: MIT License
Published: Sep 30, 2026

HighMicrosoft Sentinel analytics

Conditional Access - A Conditional Access user/group/role exclusion has changed

A Conditional Access user/group/role exclusion has changed in Azure AD.

T1078T1098

Licence: MIT License
Published: Sep 30, 2026

InformationalMicrosoft Sentinel analytics

Conditional Access - A Conditional Access policy was updated

A Conditional Access policy was updated in Entra ID.

T1562

Licence: MIT License
Published: Sep 30, 2026

LowMicrosoft Sentinel analytics

Conditional Access - A Conditional Access policy was put into report-only mode

A Conditional Access policy was put into report-only mode in Entra ID.

T1562.007

Licence: MIT License
Published: Sep 30, 2026

LowMicrosoft Sentinel analytics

Conditional Access - A Conditional Access policy was disabled

A Conditional Access policy was disabled in Entra ID.

T1562.007

Licence: MIT License
Published: Sep 30, 2026

LowMicrosoft Sentinel analytics

Conditional Access - A Conditional Access policy was deleted

A Conditional Access policy was deleted from Entra ID.

T1562.007

Licence: MIT License
Published: Sep 30, 2026

LowMicrosoft Sentinel analytics

Conditional Access - A Conditional Access app exclusion has changed

A Conditional Access app exclusion has changed in Entra ID.

T1071

Licence: MIT License
Published: Sep 30, 2026

LowMicrosoft Sentinel analytics

Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)

A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) in Entra ID.

T1562.007

Licence: MIT License
Published: Sep 30, 2026

HighMicrosoft Sentinel analytics

Azure RBAC (Elevate Access)

Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Microsoft Sentinel Analytic Rule monitors who has elevated access in your tenant so that admins can take appropriate action. [Learn more](https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal)

T1078

Licence: MIT License
Published: Sep 30, 2026

MediumMicrosoft Sentinel analytics

PowerShell Encoded Command Execution (Living off the Land)

Detects PowerShell or pwsh.exe launched with encoded command flags (-EncodedCommand, -enc, -ec, -enco). Attackers encode commands in Base64 to obfuscate malicious payloads and bypass script-based controls. Risk is elevated when a download cradle pattern is also detected. Tune AllowlistedParents for known-safe management tools such as SCCM.

T1027T1059.001

Licence: MIT License
Published: Sep 30, 2026

MediumElastic detection rules

Unusual Process Resolving AWS ECS Agent Communication Service Endpoint

Identifies a process other than the Amazon ECS agent performing a DNS lookup for an ECS Agent Communication Service (ACS) or Telemetry Service (TACS) hostname on a Linux host. The ECScape technique abuses the undocumented ACS protocol: a compromised container that can reach the instance metadata service steals the EC2 instance role credentials, then impersonates the ECS agent over ACS to receive the task role credentials of every other task scheduled on the same host.

T1526T1580

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 30, 2026

MediumElastic detection rules

AWS SSM Agent Registered via Hybrid Activation

Identifies the Amazon SSM Agent invoked with "-register" and a hybrid activation argument on a Linux host. Hybrid activation is how non-EC2 hosts are onboarded as managed nodes, but adversaries with local access can repurpose the pre-installed, root-privileged SSM Agent as a covert remote access trojan by registering it to an attacker-controlled AWS account, gaining a persistent command channel that blends in with legitimate management traffic.

T1133T1219

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 30, 2026

MediumElastic detection rules

Entra ID Application Credential Modified

Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an environment.

T1098T1098.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 30, 2026

MediumElastic detection rules

AWS Control Plane Access by Suspicious Process

Identifies a process running from a temporary or user-writable directory, or a script interpreter executing a payload from such a directory, followed by a network connection to an AWS identity, secrets, or management control plane endpoint. This detects credential abuse performed through an AWS SDK such as boto3, aws-sdk-js, or the Go SDK rather than through the aws command line binary.

T1526T1580

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 30, 2026

MediumMicrosoft Sentinel analytics

GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)

This rule identifies a match Network Sessions for which the source or destination IP address is a known GreyNoise IoC. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema

T1071

Licence: MIT License
Published: Sep 29, 2026

MediumMicrosoft Sentinel analytics

GreyNoise TI Map IP Entity to SigninLogs

This query maps any GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SigninLogs.

T1071

Licence: MIT License
Published: Sep 29, 2026

MediumMicrosoft Sentinel analytics

GreyNoise TI map IP entity to OfficeActivity

This query maps any GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in OfficeActivity.

T1071

Licence: MIT License
Published: Sep 29, 2026

MediumMicrosoft Sentinel analytics

GreyNoise TI Map IP Entity to DnsEvents

This query maps any IP indicators of compromise (IOCs) from GreyNoise Threat Intelligence (TI), by searching for matches in DnsEvents.

T1071

Licence: MIT License
Published: Sep 29, 2026

MediumMicrosoft Sentinel analytics

GreyNoise TI Map IP Entity to CommonSecurityLog

This query maps GreyNoise IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in CommonSecurityLog.

T1071

Licence: MIT License
Published: Sep 29, 2026

HighElastic detection rules

Potential TerminalFix Cloudflare Lure in PowerShell

Identifies PowerShell script blocks that print a fake Cloudflare verification lure. TerminalFix pages instruct the victim to paste a command into Windows Terminal or PowerShell. The script presents messages such as "Cloudflare verification", "Cloudflare ID:", or "I am not a robot" while it stages a payload. Review the full script block for download, extraction, and follow-on execution.

T1059T1059.001T1189T1204T1204.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

Potential Execution via FileFix Phishing Attack

Identifies the execution of Windows commands or downloaded files via the browser's dialog box. Adversaries may use phishing to instruct the victim to copy and paste malicious commands for execution via crafted phishing web pages.

T1059T1059.001T1059.003T1204T1204.002+6 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

Potential FileFix Command via Windows Explorer Address Bar

Identifies suspicious commands written to the Windows Explorer address bar history (TypedPaths). Adversaries socially engineer users to paste a command into the address bar of File Explorer or of a browser's file upload dialog, a pattern known as FileFix; the writing process is therefore explorer.exe or the browser hosting the dialog.

T1059T1059.001T1059.003T1105T1204+9 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

HighElastic detection rules

Potential ClickFix Command via Windows Run Dialog

Identifies suspicious commands written to the Windows Run dialog history (RunMRU) by explorer.exe. Adversaries socially engineer users to copy and paste malicious commands for execution, a pattern commonly seen in Fake CAPTCHA (ClickFix) campaigns. Investigate the process tree for a child of explorer.exe that matches the stored command.

T1059T1059.001T1059.003T1105T1204+5 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Sep 29, 2026

Reference	Class	Cited by
docs.aws.amazon.com/AmazonECS/latest/developerguide/task-metadata-endpoint-v4.html	Product documentation	Only this detection cites it
www.sweet.security/blog/ecscape-understanding-iam-privilege-boundaries-in-amazon-ecs	Unclassified	Only this detection cites it

Detection rules

Unusual Process Resolving AWS ECS Agent Communication Service Endpoint

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules