YARA-L rules: 18

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule lsass_memory_access_by_tool_dump_keyword_name {

  meta:
    author = "Florian Roth (Nextron Systems)"
    description = "Detects LSASS process access requests from a source process with the dump keyword in its image name"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "LSASS Memory Access by Tool With Dump Keyword In Name"
    sigma_uuid = "9bd012ee-0dff-44d7-84a0-aa698cfd87a3"
    sigma_status = "test"
    rule_id = "mr_98164cc1-0051-49c1-b915-421b3c119bfe"
    tactic = "TA0006"
    technique = "T1003.001"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Rare programs that contain the word dump in their name and access lsass"

  events:
    $process.metadata.event_type = "PROCESS_OPEN"
    re.regex($process.target.process.file.full_path, `\\lsass.exe$`) nocase
    strings.contains(strings.to_lower($process.principal.process.file.full_path), "dump")
    re.regex($process.target.resource.name, `(10|30|50|70|90|B0|D0|F0|18|38|58|78|98|B8|D8|F8|1A|3A|5A|7A|9A|BA|DA|FA|0x14C2|FF)$`) nocase

    $process.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test hostname to adjust risk score
    $risk_score = max(if($process.principal.hostname = "hostname", 0, 15))
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specfic_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specfic_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specfic_process_id = array_distinct($process.target.process.product_specific_process_id)
    $log_type = array_distinct(strings.concat($process.metadata.log_type,"/",$process.metadata.product_event_type))

  condition:
    $process
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

 rule o365_mail_access_api {

  meta:
    author = "Google Cloud Security"
    description = "Detect mail items accessed via API through an unapproved Entra ID application."
    rule_id = "mr_c8d8368c-db01-4903-a81f-bab51fc1a732"
    rule_name = "Office 365 mail accessed via unexpected application"
    type = "alert"
    platform = "azure"
    data_source = "o365"
    severity = "Medium"
    priority = "Medium"

  events:
    $email.metadata.event_type = "EMAIL_UNCATEGORIZED"
    $email.metadata.product_event_type = "MailItemsAccessed"
    $email.metadata.product_name = "Office 365"
    $email.metadata.vendor_name = "Microsoft"
    $email.security_result.action = "ALLOW"
    $email.network.http.user_agent = /Client=REST;/ nocase
    //Reference list could be used; add Entra ID applications that users would normally access mail through to this list so they are not detected
    NOT (
    $email.target.labels["ClientAppId"] = "a3883eba-fbe9-48bd-9ed3-dca3e0e84250" or //Exchange Online
    $email.target.labels["ClientAppId"] = "13937bba-652e-4c46-b222-3003f4d1ff97" or //Substrate Context Service
    $email.target.labels["ClientAppId"] = "d3590ed6-52b3-4102-aeff-aad2292ab01c" //Microsoft Office
    )
    //$email.target.labels["ClientAppId"] != ""
    $email.principal.user.userid = $user

  match:
    $user over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($email.metadata.id)
    $user_agent = array_distinct($email.network.http.user_agent)
    $target_application = array_distinct($email.target.application)
    $principal_user_userid = array_distinct($email.principal.user.userid)
    $application_guid = array_distinct($email.target.labels["ClientAppId"])
    $mail_folder = array_distinct($email.about.resource.name)

  condition:
    $email
}