CyberArk Privileged Access Security Recommended Monitor

  1[metadata]
  2creation_date = "2021/06/23"
  3integration = ["cyberarkpas"]
  4maturity = "production"
  5promotion = true
  6updated_date = "2026/09/18"
  7
  8[rule]
  9author = ["Elastic"]
 10description = """
 11Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-error level audit event which is
 12recommended for monitoring by the vendor. The event.code correlates to the CyberArk Vault Audit Action Code.
 13"""
 14false_positives = ["To tune this rule, add exceptions to exclude any event.code which should not trigger this rule."]
 15from = "now-30m"
 16index = ["filebeat-*", "logs-cyberarkpas.audit*"]
 17language = "kuery"
 18license = "Elastic License v2"
 19name = "CyberArk Privileged Access Security Recommended Monitor"
 20note = """## Setup
 21
 22The CyberArk Privileged Access Security (PAS) Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
 23
 24## Triage and analysis
 25
 26This is a promotion rule for CyberArk events, which the vendor recommends should be monitored.
 27Consult vendor documentation on interpreting specific events.
 28"""
 29references = [
 30    "https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASREF/Vault%20Audit%20Action%20Codes.htm?tocpath=Administration%7CReferences%7C_____3#RecommendedActionCodesforMonitoring",
 31]
 32risk_score = 73
 33rule_id = "c5f81243-56e0-47f9-b5bb-55a5ed89ba57"
 34rule_name_override = "event.action"
 35severity = "high"
 36tags = [
 37    "Data Source: CyberArk PAS",
 38    "Use Case: Log Auditing",
 39    "Use Case: Threat Detection",
 40    "Tactic: Privilege Escalation",
 41    "Resources: Investigation Guide",
 42    "Noise: High",
 43    "Performance: Normal",
 44    "Profile: Aggressive",
 45    "Rule Type: Custom Query (KQL)",
 46    "Domain: Identity",
 47]
 48timestamp_override = "event.ingested"
 49type = "query"
 50
 51query = '''
 52data_stream.dataset:cyberarkpas.audit and
 53  event.code:(4 or 22 or 24 or 31 or 38 or 57 or 60 or 130 or 295 or 300 or 302 or
 54              308 or 319 or 344 or 346 or 359 or 361 or 378 or 380 or 411) and
 55  not event.type:error
 56'''
 57
 58
 59[[rule.threat]]
 60framework = "MITRE ATT&CK"
 61
 62[[rule.threat.technique]]
 63id = "T1078"
 64name = "Valid Accounts"
 65reference = "https://attack.mitre.org/techniques/T1078/"
 66
 67[rule.threat.tactic]
 68id = "TA0004"
 69name = "Privilege Escalation"
 70reference = "https://attack.mitre.org/tactics/TA0004/"
 71
 72[[rule.threat]]
 73framework = "MITRE ATT&CK"
 74
 75[rule.threat.tactic]
 76id = "TA0001"
 77name = "Initial Access"
 78reference = "https://attack.mitre.org/tactics/TA0001/"
 79
 80[[rule.threat]]
 81framework = "MITRE ATT&CK"
 82
 83[[rule.threat.technique]]
 84id = "T1555"
 85name = "Credentials from Password Stores"
 86reference = "https://attack.mitre.org/techniques/T1555/"
 87
 88[rule.threat.tactic]
 89id = "TA0006"
 90name = "Credential Access"
 91reference = "https://attack.mitre.org/tactics/TA0006/"
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95
 96[[rule.threat.technique]]
 97id = "T1098"
 98name = "Account Manipulation"
 99reference = "https://attack.mitre.org/techniques/T1098/"
100
101[rule.threat.tactic]
102id = "TA0003"
103name = "Persistence"
104reference = "https://attack.mitre.org/tactics/TA0003/"