LoFP LoFP / t1552

t1552

TitleTags
a newly installed program or one that runs very rarely as part of a monthly or quarterly workflow could trigger this detection rule.
a newly installed program, or one that runs under a new or rarely used user context, could trigger this detection rule. manual interrogation of the metadata service during debugging or troubleshooting could trigger this rule.
a service principal used by a ci/cd pipeline may trigger this rule when the pipeline runs from a new ip range for the first time (e.g., migrating to a new runner pool). the 7-day history window will learn the new ips after the first occurrence.
a user may generate a shared access link to encryption key files to share with others. it is unlikely that the intended recipient is an external or anonymous user.
administrative activity
administrative or software activity
administrators accessing arc clusters from a new vpn endpoint or travel location. validate the caller identity matches an expected user and correlate with known travel or access patterns.
administrators using service principal credentials to manage arc-connected clusters during maintenance windows may trigger this rule. correlate with change management records.
as the script block is a blob of text. false positive may occur with scripts that contain the keyword as a reference or simply use it for detection.
authorization rule additions or modifications may be done by a system or network administrator. verify whether the username, hostname, and/or resource name should be making changes in your environment. authorization rule additions or modifications from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
automated processes may need to take these actions and may need to be filtered.
azure arc system components may create or update secrets and configmaps in the azure-arc and azure-arc-release namespaces during normal cluster management. filter by namespace to exclude these.
azure kubernetes admissions controller may be done by a system administrator.
ci/cd pipelines that authenticate as a service principal and then access arc clusters as part of deployment workflows will trigger this rule. identify and exclude known automation service principal app ids.
commonly run by administrators
false positives will be present based on many factors. tune the correlation as needed to reduce too many triggers.
files that accidentally contain these strings
google cloud kubernetes admission controller may be done by a system administrator.
helm operations managed through arc may create release secrets (prefixed with sh.helm.release.v1). these are normal arc lifecycle operations.
if known behavior is causing false positives, it can be exempted from the rule.
it's recommended that you rotate your access keys periodically to help keep your storage account secure. normal key rotation can be exempted from the rule. an abnormal time frame and/or a key rotation from unfamiliar users, hosts, or locations should be investigated.
key being modified or deleted may be performed by a system administrator.
key modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
key vault being modified or deleted may be performed by a system administrator.
key vault modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
legitimate access of the console history file is possible
legitimate administration activities
legitimate certificate exports by administrators. additional filters might be required.
legitimate snmp configuration changes may trigger this detection during routine network maintenance or initial device setup. network administrators often need to configure snmp for monitoring and management purposes. to reduce false positives, consider implementing a baseline of expected administrative activities, including approved administrative usernames, typical times for snmp configuration changes, and scheduled maintenance windows. you may also want to create a lookup table of approved snmp hosts and filter out alerts for these destinations.
legitimate software, cleaning hist file
legitimate usage of chflags by administrators and users.
legitimate usage of the utility by administrators to query the event log
legitimate use of trufflehog by security teams or developers.
limited false positives are expected as spinstall0.aspx is not a legitimate sharepoint component. however, security teams investigating the incident might also access this file for analysis purposes. verify the source ip addresses against known security team ips and the timing of the requests in relation to the initial exploitation attempt.
microsoft windows installers leveraging rundll32 for installation.
modifying the kubernetes admission controller may need to be done by a system administrator.
not commonly run by administrators, especially if remote logging is configured
not commonly run by administrators. also whitelist your known good certificates
secrets being modified or deleted may be performed by a system administrator.
secrets modified or deleted from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
the kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret
there is a potential for false positives if the access to the service account token or certificate is used for legitimate purposes, such as debugging or troubleshooting. it is important to investigate any alerts generated by this rule to determine if they are indicative of malicious activity or part of legitimate container activity.
there is a potential for false positives if the service account token or certificate is used for legitimate purposes, such as debugging or troubleshooting. it is important to investigate any alerts generated by this rule to determine if they are indicative of malicious activity or part of legitimate container activity.
there is a risk of false positives if there are several containers named the same, as the rule may correlate the request to the wrong container.
third party software may access this outlook registry.
this is an intentional action taken by aws in the event of compromised credentials. follow the instructions specified in the support case created for you regarding this event.
this is very uncommon behavior and should result in minimal false positives, ensure validity of the triggered event and include exceptions where necessary.
unknown
unlikely
users searching excessively or possible false positives related to matching conditions.
when a legitimate new user logins for the first time, this activity will be detected. check how old the account is and verify that the user activity is legitimate.
when a new application owner is added by an administrator
when and administrator is making legitimate appid uri configuration changes to an application. this should be a planned event.