Align ESQL Queries with Field Naming Guidelines

Summary

This issue tracks updates to existing ESQL-based detection rules to align with the new field naming guidelines established by the TRADE team.

Objective

Ensure all dynamic or transformed fields in prebuilt ESQL rules follow the approved esql. prefixing convention and related guardrails to improve clarity, maintainability, and telemetry support.

Tasks

• Audit existing ESQL rules for field naming inconsistencies
• Apply esql. prefix to all dynamic or transformed fields
• Preserve original ECS or integration field paths when transformed
• Use .count, .avg, .hash, etc. suffixes for stats and other processing commands
• Avoid overwriting ECS field names with transformed values
• Apply consistent naming for all field-generating commands (eval, stats, grok, dissect, mv_, rename, etc.)

Rules to Review

• Potential Widespread Malware Infection Across Multiple Hosts
• Microsoft Azure or Mail Sign-in from a Suspicious Source
• AWS EC2 Multi-Region DescribeInstances API Calls
• AWS Discovery API Calls via CLI from a Single Resource
• AWS Service Quotas Multi-Region GetServiceQuota Requests
• AWS EC2 EBS Snapshot Shared or Made Public
• AWS S3 Bucket Enumeration or Brute Force
• AWS EC2 EBS Snapshot Access Removed
• Potential AWS S3 Bucket Ransomware Note Uploaded
• AWS S3 Object Encryption Using External KMS Key
• AWS S3 Static Site JavaScript File Uploaded
• AWS Access Token Used from Multiple Addresses
• AWS Signin Single Factor Console Login with Federated User
• AWS IAM Login Profile Added for Root - No Change Needed
• AWS IAM User Created Access Keys For Another User - No Change Needed
• AWS IAM AdministratorAccess Policy Attached to Group
• AWS IAM AdministratorAccess Policy Attached to Role
• AWS IAM AdministratorAccess Policy Attached to User
• AWS STS Role Chaining - No Change Needed
• AWS Bedrock Invocations without Guardrails Detected by a Single User Over a Session
• AWS Bedrock Guardrails Detected Multiple Violations by a Single User Over a Session
• AWS Bedrock Guardrails Detected Multiple Policy Violations Within a Single Blocked Request
• Unusual High Confidence Content Filter Blocks Detected
• Potential Abuse of Resources by High Token Count and Large Response Sizes
• AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single User
• Unusual High Denied Sensitive Information Policy Blocks Detected
• Unusual High Denied Topic Blocks Detected
• AWS Bedrock Detected Multiple Validation Exception Errors by a Single User
• Unusual High Word Policy Blocks Detected
• Microsoft Entra ID Concurrent Sign-Ins with Suspicious Properties
• Azure Entra MFA TOTP Brute Force Attempts
• Microsoft Entra ID Sign-In Brute Force Activity
• Microsoft Entra ID Exccessive Account Lockouts Detected
• Microsoft 365 Brute Force via Entra ID Sign-Ins
• Deprecated - Azure Entra Sign-in Brute Force Microsoft 365 Accounts by Repeat Source - Deprecated
• Microsoft Entra ID Session Reuse with Suspicious Graph Access
• Suspicious Microsoft OAuth Flow via Auth Broker to DRS
• Potential Denial of Azure OpenAI ML Service
• Azure OpenAI Insecure Output Handling
• Potential Azure OpenAI Model Theft
• M365 OneDrive Excessive File Downloads with OAuth Token
• Multiple Microsoft 365 User Account Lockouts in Short Time Window
• Potential Microsoft 365 User Account Brute Force
• Suspicious Microsoft 365 UserLoggedIn via OAuth Code
• Multiple Device Token Hashes for Single Okta Session
• Multiple Okta User Authentication Events with Client Address
• Multiple Okta User Authentication Events with Same Device Token Hash
• High Number of Okta Device Token Cookies Generated for Authentication
• Okta User Sessions Started from Different Geolocations
• High Number of Egress Network Connections from Unusual Executable
• Unusual Base64 Encoding/Decoding Activity
• Potential Port Scanning Activity from Compromised Host
• Potential Subnet Scanning Activity from Compromised Host
• Unusual File Transfer Utility Launched
• Potential Malware-Driven SSH Brute Force Attempt
• Unusual Process Spawned from Web Server Parent
• Unusual Command Execution from Web Server Parent
• Rare Connection to WebDAV Target
• Potential PowerShell Obfuscation via Invalid Escape Sequences
• Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
• Potential PowerShell Obfuscation via Character Array Reconstruction
• Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
• Potential PowerShell Obfuscation via High Numeric Character Proportion
• Potential Dynamic IEX Reconstruction via Environment Variables
• Dynamic IEX Reconstruction via Method String Access
• PowerShell Obfuscation via Negative Index String Reversal
• Potential PowerShell Obfuscation via Reverse Keywords
• Potential PowerShell Obfuscation via String Concatenation
• Potential PowerShell Obfuscation via String Reordering
• Potential PowerShell Obfuscation via Special Character Overuse
• Potential Malicious PowerShell Based on Alert Correlation
• Potential PowerShell Obfuscation via High Special Character Proportion
• Unusual File Creation by Web Server