credential_access_ml_windows_anomalous_metadata_process.toml

[metadata]
creation_date = "2020/09/22"
maturity = "production"
updated_date = "2022/08/24"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"

[rule]
anomaly_threshold = 50
author = ["Elastic"]
description = """
Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order
to harvest credentials or user data scripts containing secrets.
"""
false_positives = [
    """
    A newly installed program or one that runs very rarely as part of a monthly or quarterly workflow could trigger this
    detection rule.
    """,
]
from = "now-45m"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = ["v3_windows_rare_metadata_process"]
name = "Unusual Windows Process Calling the Metadata Service"
risk_score = 21
rule_id = "abae61a8-c560-4dbd-acca-1e1438bff36b"
severity = "low"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "ML", "Credential Access"]
type = "machine_learning"

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"


    [[rule.threat.technique.subtechnique]]
    id = "T1552.005"
    name = "Cloud Instance Metadata API"
    reference = "https://attack.mitre.org/techniques/T1552/005/"


[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"