LoFP LoFP / cross-platform

cross-platform rule

TitleTags
ai coding assistants running on cloud instances may read their own credential file and then fall back to the instance metadata service for cloud provider authentication (for example gemini cli on google compute engine). confirm the process is the assistant itself and that the credential file belongs to that assistant.
application defects, stress tests, or intentionally low php memory limits may generate similar errors. confirm the complete signature, source, timing, and surrounding requests before escalating.
approved red-team, evaluation, or detection-engineering tests that deliberately include jailbreak strings (such as dan or \"ignore previous instructions\") in prompts or regex experiments run through genai agent shells. exclude known lab hosts or lower severity after validation.
approved third-party applications that use google drive download urls.
authorized github actions runner with no malicious workflow actions.
authorized github repository with no malicious workflow actions.
authorized infrastructure teardown automation may legitimately invoke these commands. correlate with change management records and known deployment pipeline identities before escalating.
authorized red team engagements and cloud security assessments use the same frameworks. correlate with known assessment windows, operator identities, and approved change records before escalating.
authorized vulnerability research or penetration testing of php2shell will trigger this rule.
automated configuration management or monitoring scripts that use lolbins via ssm for legitimate purposes. consider excluding known automation accounts or specific command patterns.
automation, ci runners, and platform engineering scripts may legitimately print tokens or dump kubeconfig across providers in one session. baseline approved identities and runner images before tuning thresholds.
break-glass troubleshooting by administrators using curl against 168.63.129.16. confirm the change window and exclude the admin host or user if the activity is authorized.
build systems and ci runners frequently compile or download binaries into temporary directories and then make aws api calls as part of integration tests. exclude known runner paths and restrict to interactive or production hosts if alert volume is high.
certain tools or automated software may enumerate hardware information. these tools can be exempted via user name or process arguments to eliminate potential noise.
changes to the shell profile tend to be noisy, a tuning per your environment will be required.
custom inventory or health scripts that call wireserver with curl or powershell. validate the command line and exclude the specific signed binary or scheduled task after review.
custom network security rules that triggers on a proxy or gateway used by users to access azure or o365.
data engineers and devops teams legitimately use rclone, s5cmd, and s3cmd for bulk data transfers. this rule gates on a scripted parent to suppress interactive use, but automation pipelines that shell out to these tools may still trigger alerts. the 7-day new-terms window suppresses recurring invocations of the same client on the same host after the first alert. allowlist known pipeline executor paths if additional tuning is needed.
developer or deployment scripts running on cloud-hosted macos or windows instances may read a package registry or source control token and then request instance role credentials from the same interpreter (for example a release script that publishes a package and uploads artifacts with the instance role). validate the script path, parent process and whether the host is an approved build or release system.
developers performing browsers plugin or extension debugging.
developers who explicitly instruct an agent to tear down a development environment or rotate access keys will trigger this rule. confirm intent with the user before escalating.
development, staging, and quality-assurance systems may generate frequent novel fatal errors during testing.
documentation that mentions \"developer mode\", \"jailbreak\", or \"without restrictions\" in a non-adversarial context. review the full parent and child command lines before escalating.
endpoint security installers, updaters and post installation verification scripts.
gitleaks is a legitimate open-source tool used by security professionals and developers to search for sensitive information, such as passwords, api keys, and other secrets, within code repositories. it is commonly employed during security assessments and code reviews to identify potential vulnerabilities.
legitimate administrative tasks using ssm to run system utilities may trigger this rule. review the command context, user identity, and timing to determine if the activity is authorized.
legitimate automation that deploys configuration via azure run command and launches powershell with unrestricted policy and numbered script files (for example `script1.ps1`) may match. baseline known deployment pipelines, vm names, and principal ids before tuning.
legitimate configuration management, extension deployment, or automation that uses azure run command with the same powershell or shell script paths may match. baseline approved vm names, script naming, and deployment windows before tuning.
legitimate operators using aws systems manager session manager to administer instances will spawn child processes under the session worker. tune with host, user, or command-line exclusions for known automation and break-glass workflows.
legitimate publicly shared files from google drive.
legitimate support, diagnostic, accessibility, update, or enterprise management workflows may cause zoom to launch command-line utilities. verify the executable path, command line, code signature, and surrounding user activity before adding exceptions.
legitimate use of the `sendcommand` api call to execute commands on ec2 instances using the ssm service may be done by system administrators or devops engineers for legitimate purposes.
misconfiguration, system reboot, network issues or expected uninstall of the elastic defend agent.
new deployments, application defects, dependency changes, resource exhaustion, and configuration errors can legitimately produce a first-seen php fatal error.
newly deployed network devices may legitimately generate other detection alerts during commissioning, testing, vulnerability scanning, or monitoring validation. shared addresses, network address translation, and incomplete asset attribution can also cause unrelated activity to correlate to the exporter ip.
routine automation, ci/cd jobs, infrastructure tooling, package management, and expected artifact downloads to destinations that are not yet in the allow-list may be classified as suspicious. add persistent, verified benign destinations to the deterministic allow-list.
security engineers running prowler, scoutsuite, or cartography on a schedule for compliance or asset inventory will trigger this rule. add host or user exceptions for known security tooling environments.
security teams running authorized cloud posture assessments or infrastructure cleanup may legitimately issue these commands. correlate with change management windows and operator identity before escalating.
stress tests, fault-injection exercises, fuzzing, and authorized vulnerability testing may intentionally trigger segmentation faults or access violations.
support engineers and iot operators may run localproxy on field devices or jump hosts that legitimately use aws iot secure tunneling. confirm the host is an approved device-management asset, the parent process and binary path are expected, and the destination mapping points at an authorized local service. allowlist by host, user, or signed install path where that use is documented.
the ssm agent may invoke short-lived utilities (for example identity or environment probes) during session setup. additional exclusions may be required in your environment.
there is a potential for false positives if the access to the service account token or certificate is used for legitimate purposes, such as debugging or troubleshooting. it is important to investigate any alerts generated by this rule to determine if they are indicative of malicious activity or part of legitimate container activity.
there is a potential for false positives if the direct interactive kubernetes api requests are used for legitimate purposes, such as debugging or troubleshooting. it is important to investigate any alerts generated by this rule to determine if they are indicative of malicious activity or part of legitimate container activity.
there is a risk of false positives if there are several containers named the same, as the rule may correlate the request to the wrong container.
this is meant to run only on datasources using elastic agent 7.14+ since versions prior to that will be missing the necessary field, resulting in false positives.
this rule is not looking for threat activity. disable the rule if you're already familiar with alerts.
trufflehog is a legitimate open-source tool used by security professionals and developers to search for sensitive information, such as passwords, api keys, and other secrets, within code repositories. it is commonly employed during security assessments and code reviews to identify potential vulnerabilities.
web-server, runtime, module, extension, or application defects can legitimately crash a worker after an upgrade, configuration change, or unusual request.