### RDP off hour events
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-RDP off hour events",
  "description": "Detects RDP connections and session reconnections during off-hours.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| eval hour = DATE_EXTRACT("hour_of_day", @timestamp)
| eval dow = DATE_EXTRACT("day_of_week", @timestamp)
| where (event.code == "4778" and event.action == "session-reconnected") or (event.code == "4624" and winlog.event_data.LogonType == "10")
| where not (dow in (1, 2, 3, 4, 5) and hour in (7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17))""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Domain admin activities off hour
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Domain admin activities off hour",
  "description": "Detects domain admin activities occurring outside of normal business hours.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| eval hour = DATE_EXTRACT("hour_of_day", @timestamp)
| eval dow = DATE_EXTRACT("day_of_week", @timestamp)
| where event.code in ("4767", "4723", "4724", "4740", "4738", "4720") 
| where related.user LIKE "adm.%"
| where not (dow in (1, 2, 3, 4, 5) and hour in (7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17))""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### High-Priv-Group-Membership-Change-Alerts (German)
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-High-Priv-Group-Membership-Change-Alerts-DE",
  "description": "Detects modifications to high privilege groups (German AD names).",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| where group.name in ("Server-Operatoren", "Konten-Operatoren", "Domänen-Admins", "SophosAdministrator", "SophosDomainAdministrator", "Schema-Admins", "SophosPowerUser", "administratoren", "Server-Admins") or group.name LIKE "T0%" or group.name LIKE "T1%" or group.name LIKE "T2*"
| where event.code in ("4728", "4756", "4737", "4727", "4729", "4733", "4735", "4732")""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### High-Priv-Group-Membership-Change-Alerts (English)
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-High-Priv-Group-Membership-Change-Alerts-EN",
  "description": "Detects modifications to high privilege groups (English AD names).",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| where group.name in ("Server Operators", "Account Operators", "Domain Admins", "SophosAdministrator", "SophosDomainAdministrator", "Schema Admins", "SophosPowerUser", "Group Policy Creator Owners", "Enterprise Admins", "Administrators", "Server-Admins", "Backup Operators") or group.name LIKE "T0%" or group.name LIKE "T1%" or group.name LIKE "T2*"
| where event.code in ("4728", "4756", "4737", "4727", "4729", "4733", "4735", "4732")""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Create User-Off hours
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Create User-Off hours",
  "description": "Detects user creation events during off-hours.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| eval hour = DATE_EXTRACT("hour_of_day", @timestamp)
| eval dow = DATE_EXTRACT("day_of_week", @timestamp)
| where event.code == "4722"
| where not (dow in (1, 2, 3, 4, 5) and hour in (8, 9, 10, 11, 12, 13, 14, 15, 16, 17))""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Kerberos Golden Ticket
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Kerberos Golden Ticket",
  "description": "Detects potential Kerberos Golden Ticket requests.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| where event.code == "4769"
| where not (winlog.event_data.TargetDomainName LIKE "*promotech.at*" or winlog.event_data.TargetDomainName LIKE "*PROMOTECH.AT*" or winlog.event_data.TargetDomainName LIKE "*pm.dir*" or winlog.event_data.TargetDomainName LIKE "*PMT.DIR*")
| where not (event.outcome LIKE "*failure*")""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### whoami
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-whoami",
  "description": "Detects execution of whoami.exe, often used by attackers for reconnaissance.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| where process.name == "whoami.exe" """,
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Start program OffHours from Programdata
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Start program OffHours from Programdata",
  "description": "Detects processes starting from ProgramData directory outside business hours.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| eval hour = DATE_EXTRACT("hour_of_day", @timestamp)
| eval dow = DATE_EXTRACT("day_of_week", @timestamp)
| where event.code in ("1", "3") and data_stream.dataset == "windows.sysmon_operational"
| where process.executable LIKE "*ProgramData*"
| where not (dow in (1, 2, 3, 4, 5) and hour in (8, 9, 10, 11, 12, 13, 14, 15, 16, 17))""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Access to the Internet (SYSMON)
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Access to the Internet (SYSMON)",
  "description": "Detects internet access attempts captured by Sysmon from unexpected sources.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| where event.code == "3" and data_stream.dataset == "windows.sysmon_operational"
| where not CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/16", "192.168.0.0/16", "::1")""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### MALWARE ALERT ! Ongoing encryption
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-MALWARE ALERT Ongoing encryption",
  "description": "Detects suspicious file paths indicative of ongoing ransomware encryption.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| where file.path.text LIKE "C:\\\\aa42\\\\%" """,
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Potential Hacker activities
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Potential Hacker activities",
  "description": "Detects execution of common hacker reconnaissance and lateral movement tools during off-hours.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| eval hour = DATE_EXTRACT("hour_of_day", @timestamp)
| eval dow = DATE_EXTRACT("day_of_week", @timestamp)
| where process.name in ("ver.exe", "tasklist.exe", "systeminfo.exe", "netstat", "nbtstat", "set", "Qprocess.exe", "Net.exe", "echo", "DSquery.exe", "echo.exe", "dumpel.exe", "logparser.exe", "tracert.exe", "quser.exe", "schtasks.exe", "netsh", "reg.exe", "taskkill.exe", "klist.exe", "del.exe", "psexec.exe")
| where not (dow in (1, 2, 3, 4, 5) and hour in (7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17))
| where process.command_line is not null
| where user.name != "SYSTEM"
| where not (process.command_line LIKE "*Barracuda*")""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Low Diskspace on Kibana Server (Free space < 100GB)
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Low Diskspace on Kibana Server (Free)",
  "description": "Detects if Kibana server free disk space drops below 100GB.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from metrics-*
| where system.filesystem.device_name == "/dev/mapper/ubuntu--vg-ubuntu--lv"
| where system.filesystem.free < 100000000000""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Low Diskspace on Kibana Server (Available space < 100GB)
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Low Diskspace on Kibana Server (Available)",
  "description": "Detects if Kibana server available disk space drops below 100GB.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from metrics-*
| where system.filesystem.device_name == "/dev/mapper/ubuntu--vg-ubuntu--lv"
| where system.filesystem.available < 100000000000""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Low Diskspace on Kibana Server (>80% Used)
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Low Diskspace on Kibana Server (>80% Used)",
  "description": "Detects if Kibana server disk usage exceeds 80%.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from metrics-*
| where system.filesystem.device_name == "/dev/mapper/ubuntu--vg-ubuntu--lv" 
| stats avg_used_pct=avg(system.filesystem.used.pct)*100 by agent.name 
| where avg_used_pct>80""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Agent not responding
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Agent not responding",
  "description": "Detects agents that have not reported data in the last 30 minutes.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from metrics-*
| where agent.type == "metricbeat"
| stats last_time = max(to_long(@timestamp)) by agent.name
| eval mins_ago = (to_long(now()) - last_time)/60000
| eval last_time=to_datetime(last_time+2*3600*1000)
| where mins_ago >= 30""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Windows Updates available
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Windows Updates available",
  "description": "Detects servers that have pending Windows updates available.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-winlog.update*
| where winlog.event_data.updateCount != "0"
| stats os=mv_last(values(host.os.name)), message=mv_last(values(message)) by host.name=agent.name""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Sudo test
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Sudo test",
  "description": "Detects sudo command executions.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from logs-*
| where system.auth.sudo.command is not null
| where user.name is not null""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}

### Disk usage above 80%
POST kbn:api/detection_engine/rules
{
  "name": "00-Custom-Disk usage above 80%",
  "description": "Detects disk usage above 80% on any monitored host.",
  "risk_score": 99,
  "severity": "critical",
  "type": "esql",
  "language": "esql",
  "query": """from metrics-* 
| stats avg_used_pct=avg(system.filesystem.used.pct)*100 by host.name 
| where avg_used_pct>80""",
  "enabled": true,
  "interval": "1m",
  "from": "now-2m"
}