[New Rule] Azure WireServer Abuse Related Detections - #6668
Merged
Merged
Conversation
Detects the documented WireServer/HostGAPlugin scrape chain used to decrypt transport certs and replay guest-agent SAS against Azure Storage. Co-authored-by: Cursor <cursoragent@cursor.com>
terrancedejesus
added
Integration: Azure
|
⛔️ Test failed Results
|
terrancedejesus
changed the title
Clarified the context of Azure Storage SAS retrieval detection and false positives.
|
⛔️ Test failed Results
|
Customer StorageRead cannot see Microsoft fabric $system blobs, so that rule is removed. OpenSSL now matches cms and smime decrypt and excludes waagent LinuxTransport generation. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
|
⛔️ Test failed Results
|
terrancedejesus
marked this pull request as ready for review
August 27, 2026 15:02
terrancedejesus
requested review from
Aegrah,
Samirbous,
bryans3c,
imays11 and
w0rk3r
August 27, 2026 15:03
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces a set of new detection rules aimed at identifying Azure WireServer/HostGAPlugin abuse (GoalState/certificate/vmSettings scraping and follow-on anonymous blob access) and adds schema support for a new Azure field used by the rules.
Changes:
- Add a Network Packet Capture rule to detect WireServer/HostGAPlugin HTTP requests with unexpected user agents.
- Add Elastic Defend rules to detect unusual guest process connections to WireServer/HostGAPlugin and suspicious OpenSSL CMS decrypt / LinuxTransport certificate generation on Linux.
- Add an Azure Platform Logs new-terms rule for first-seen anonymous Azure Storage blob read activity, plus schema support for
azure.resource.id.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| rules/network/credential_access_azure_wireserver_http_request_unexpected_user_agent.toml | New EQL rule for detecting WireServer/HostGAPlugin HTTP requests with non-guest-agent user agents. |
| rules/linux/credential_access_azure_wireserver_openssl_cms_decrypt.toml | New Linux EQL rule for OpenSSL decrypt / LinuxTransport cert generation behaviors associated with WireServer abuse. |
| rules/integrations/azure/discovery_azure_storage_anonymous_blob_access_unusual_resource.toml | New Azure Platform Logs new-terms rule for first-seen anonymous blob read activity on a resource. |
| rules/cross-platform/credential_access_azure_wireserver_unusual_process_connection.toml | New cross-platform new-terms rule for unusual process-to-WireServer/HostGAPlugin connections in endpoint network telemetry. |
| detection_rules/etc/non-ecs-schema.json | Adds azure.resource.id mapping needed by the new Azure new-terms rule. |
Suppressed comments (1)
rules/cross-platform/credential_access_azure_wireserver_unusual_process_connection.toml:15
- The rule description says “system python used by waagent” is excluded, but the query actually excludes
/usr/bin/python3*broadly (and doesn’t otherwise match Linuxpython/python3by name). Consider rewording the description so it reflects the actual exclusion behavior.
bun, or similar tools to enumerate versions, pull transport certificates, and read HostGAPlugin /vmSettings. Azure
guest-agent binaries and system python used by waagent are excluded. Descendants of the guest agent are not excluded:
Run Command payloads execute in that tree.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Updated the 'updated_date' field to match the creation date.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
⛔️ Test failed Results
|
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
bryans3c
reviewed
Sep 4, 2026
bryans3c
reviewed
Sep 4, 2026
bryans3c
approved these changes
Sep 4, 2026
bryans3c
left a comment
bryans3c
left a comment
Contributor
There was a problem hiding this comment.
Some nits, LGTM! Only to review if the User Agents exclusions are truly needed
Aegrah
approved these changes
Sep 9, 2026
| id = "T1140" | ||
| name = "Deobfuscate/Decode Files or Information" | ||
| reference = "https://attack.mitre.org/techniques/T1140/" | ||
|
|
Contributor
There was a problem hiding this comment.
This Defense Evasion mapping has no matching Tactic: Defense Evasion tag, so it fails the rule taxonomy convention. Adding that tag alongside Tactic: Credential Access could keep the metadata consistent with the ATT&CK entries.
| ) or | ||
| process.executable: ( | ||
| ./* or /tmp/* or /var/tmp/* or /dev/shm/* or /run/* or /var/run/* or | ||
| /home/*/* or /root/* or "C:\\Users\\*" or "?:\\ProgramData\\*" |
Contributor
There was a problem hiding this comment.
These windows process executable paths in KQL will not work because of the quotes.
| ) and | ||
| not process.executable: ( | ||
| /usr/sbin/waagent or /usr/bin/waagent or /usr/bin/python3* or | ||
| "?:\\WindowsAzure\\Packages\\*" or "?:\\WindowsAzure\\SecAgent\\*" |
| @@ -0,0 +1,154 @@ | |||
| [metadata] | |||
| creation_date = "2026/08/17" | |||
| integration = ["network_traffic"] | |||
Contributor
There was a problem hiding this comment.
Could we extend coverage here? Cc @eric-forte-elastic
Contributor
There was a problem hiding this comment.
Taking a look, if the goal is to see the HTTP traffic coming from the host through the virtual IP path from the host back to the Azure WireServer service, we would probably only be able to see it from that host. So for other integrations we would need there to be a network sensor on the given host which is generally not done for zeek, Corelight, etc. so we may end up just using network_traffic.
terrancedejesus
commented
Sep 10, 2026
Co-authored-by: Bryan Porras <bryan.porras@elastic.co> Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
|
⛔️ Test failed Results
|
Name-based exclusions did not match lab telemetry; agent binaries run from WindowsAzure Packages/GuestAgent/SecAgent and /usr/sbin/waagent. OpenSSL keeps the waagent argument-path filter and does not exclude Python, which is also the TP parent.
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
| setup = """## Setup | ||
|
|
||
| Deploy the [Network Packet Capture](https://www.elastic.co/docs/reference/integrations/network_traffic) integration | ||
| via Fleet on Azure virtual machines. Default HTTP port lists do not include HostGAPlugin. |
Contributor
There was a problem hiding this comment.
Windows also needs Npcap installed too right?
|
⛔️ Test failed Results
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary - What I changed
Azure VMs expose WireServer at
168.63.129.16:80and HostGAPlugin at:32526. Those endpoints return GoalState, transport certificates, andvmSettings/protectedSettingsthat embed SAS URLs for Microsoft fabric blobs. CyberCX and NetSPI documented decrypting the LinuxTransport / CRP cert and reading those settings without the IMDS metadata header. From a compromised guest or via SSRF, an attacker scrapes WireServer, decrypts the transport cert, and can walk anonymously accessible blobs.:80) or HostGAPlugin (:32526)openssl cms/smime -decryptor LinuxTransport cert generation outside waagent pathsHow To Test
Validated against TRADE emulation telemetry (
wslin5b7592/wswin5b7592): StorageRead platform logs, Elastic Defend network, and NPC HTTP on ports 80 and 32526.Checklist
Rule: New