YARA-L rules: 10

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule gcp_unauthorized_gke_pod_token_endpoint_usage {

  meta:
    author = "Drew Pilarski - Tempus AI"
    description = "Alerts when an authorization token originating from GKE activity is subsequently used within a command line on an endpoint system, suggesting potential credential exfiltration and reuse."
    rule_id = "mr_c9a0cb63-0e35-45eb-8b43-ae48385985dc"
    rule_name = "GCP_Uunauthorized_GKE_Pod_Token_Endpoint_Usage"
    tactic = "TA0008"
    technique = "T1550.001"
    type = "Alert"
    platform = "GCP"
    data_source = "Cloud Audit Logs"
    severity = "Medium"  // Adjust based on your risk assessment
    priority = "Medium"  // Adjust based on your incident response process

  events:
    // This pulls the auth token from application in kubernetes events
    $app_token.metadata.vendor_name = "Google"
    $app_token.metadata.log_type = "GCP_CLOUDAUDIT"
    $app_token.metadata.base_labels.log_types = "KUBERNETES_NODE"
    $namespace = $app_token.metadata.base_labels.namespaces
    $traceIdValue = $app_token.about.labels["traceId"]
    $pod_name = $app_token.target.resource_ancestors.attribute.labels["pod_name"]
    $auth_token = strings.concat("Authorization: ", $app_token.about.labels["Authorization"])

    //This block enriches the auth token statement sinces its missing critical field
    $k8_enrich.metadata.vendor_name = "Google"
    $k8_enrich.metadata.log_type = "GCP_CLOUDAUDIT"
    $k8_enrich.metadata.base_labels.log_types = "KUBERNETES_NODE"
    $traceIdValue = $k8_enrich.about[0].labels[0].value
    $k8_enrich.target.ip != ""
    $pod_ip_1 = $k8_enrich.target.ip[0]
    $email = $k8_enrich.target.user.email_addresses

    $comp_token.metadata.event_type = "PROCESS_LAUNCH"
    $comp_token.metadata.log_type = "CS_EDR"
    $comp_token.target.process.command_line = /Bearer/
    $auth_token = strings.concat("Authorization: ", re.capture($comp_token.target.process.command_line, /Bearer [^\ |^\"]*/))
    $computer_name = $comp_token.principal.asset.hostname
    $tar_process = $comp_token.target.process.command_line

    $comp_enrich.metadata.event_type = "USER_LOGIN"
    $comp_enrich.metadata.log_type = "CS_EDR"
    $computer_name = $comp_enrich.principal.asset.hostname
    $username = $comp_enrich.target.user.userid

  match:
    $traceIdValue, $auth_token, $computer_name over 24h

  outcome:
    $token = array_distinct($auth_token)
    $k8_account = array_distinct($email)
    $comp_user = array_distinct($username)
    $hostname = array_distinct($computer_name)
    $tar_processline = array_distinct($tar_process)
    $auth_t_namespace = array_distinct($namespace)
    $pod = array_distinct($pod_name)
    $pod_ip = array_distinct($pod_ip_1)
    $traceId = array_distinct($traceIdValue)
    $action = array_distinct($app_token.metadata.product_event_type)
    $account_name = array_distinct($comp_enrich.principal.user.email_addresses)

  condition:
    $app_token and $k8_enrich and $comp_token and $comp_enrich
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule modify_user_shell_folders_startup_value {

  meta:
    author = "frack113"
    description = "Detect modification of the startup key to a path where a payload could be stored to be launched during startup"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Modify User Shell Folders Startup Value"
    rule_id = "mr_bf813e89-427f-46e4-a671-bb3eea037725"
    sigma_uuid = "9c226817-8dc9-46c2-a58d-66655aafd7dc"
    sigma_status = "test"
    tactic = "TA0003"
    //tactic = "TA0004"
    technique = "T1547.001"
    type = "Detection"
    data_source = "Sysmon Windows Registry"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Unknown"

  events:
    $reg.metadata.event_type = "REGISTRY_MODIFICATION"
    strings.contains(strings.to_lower($reg.target.registry.registry_key), "software\\microsoft\\windows\\currentversion\\explorer\\user shell folders")
    re.regex($reg.target.registry.registry_key, `Startup$`) nocase

    $reg.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($reg.principal.user.userid = "user" and $reg.principal.hostname = "hostname", 0, 15))
    $principal_hostname = array_distinct($reg.principal.hostname)
    $principal_process_pid = array_distinct($reg.principal.process.pid)
    $principal_process_file_full_path = array_distinct($reg.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($reg.principal.process.product_specific_process_id)
    $principal_user_userid = array_distinct($reg.principal.user.userid)
    $target_registry_key = array_distinct($reg.target.registry.registry_key)
    $target_registry_value_data = array_distinct($reg.target.registry.registry_value_data)
    $log_type = array_distinct(strings.concat($reg.metadata.log_type,"/",$reg.metadata.product_event_type))

  condition:
    $reg
}