sigma-rules/rules/ml/credential_access_ml_linux_anomalous_metadata_process.toml

[metadata]
creation_date = "2020/09/22"
integration = ["auditd_manager", "endpoint"]
maturity = "production"
updated_date = "2023/07/27"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"

[rule]
anomaly_threshold = 50
author = ["Elastic"]
description = """
Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order
to harvest credentials or user data scripts containing secrets.
"""
false_positives = [
    """
    A newly installed program or one that runs very rarely as part of a monthly or quarterly workflow could trigger this
    detection rule.
    """,
]
from = "now-45m"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = ["v3_linux_rare_metadata_process"]
name = "Unusual Linux Process Calling the Metadata Service"
risk_score = 21
rule_id = "9d302377-d226-4e12-b54c-1906b5aec4f6"
severity = "low"
tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Rule Type: ML", "Rule Type: Machine Learning", "Tactic: Credential Access"]
type = "machine_learning"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

  [[rule.threat.technique.subtechnique]]
  id = "T1552.005"
  name = "Cloud Instance Metadata API"
  reference = "https://attack.mitre.org/techniques/T1552/005/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"