sigma-rules/rules/ml/ml_linux_anomalous_metadata_process.toml

[metadata]
creation_date = "2020/09/22"
maturity = "production"
updated_date = "2021/03/03"

[rule]
anomaly_threshold = 50
author = ["Elastic"]
description = """
Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order
to harvest credentials or user data scripts containing secrets.
"""
false_positives = [
    """
    A newly installed program or one that runs very rarely as part of a monthly or quarterly workflow could trigger this
    detection rule.
    """,
]
from = "now-45m"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = ["linux_rare_metadata_process", "v2_linux_rare_metadata_process"]
name = "Unusual Linux Process Calling the Metadata Service"
risk_score = 21
rule_id = "9d302377-d226-4e12-b54c-1906b5aec4f6"
severity = "low"
tags = ["Elastic", "Host", "Linux", "Threat Detection", "ML"]
type = "machine_learning"