YARA-L rules: 1f

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule credential_dumping_attempt_via_werfault {

  meta:
    author = "Florian Roth (Nextron Systems)"
    description = "Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_werfault.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Credential Dumping Attempt Via WerFault"
    sigma_uuid = "e5b33f7d-eb93-48b6-9851-09e1e610b6d7"
    sigma_status = "test"
    rule_id = "mr_b3448ab7-b1a2-41f7-9cd4-151c3cb2e2d6"
    tactic = "TA0006"
    technique = "T1003.001"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Actual failures in lsass.exe that trigger a crash dump (unlikely), unknown cases in which WerFault accesses lsass.exe"

  events:
    $process.metadata.event_type = "PROCESS_OPEN"
    re.regex($process.target.process.file.full_path, `\\lsass\.exe$`) nocase
    re.regex($process.principal.process.file.full_path, `\\werfault\.exe$`) nocase
    $process.target.resource.name = "0x1FFFFF" nocase
    $process.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test hostname to adjust risk score
    $risk_score = max(if($process.principal.hostname = "hostname", 0, 15))
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specfic_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specfic_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specfic_process_id = array_distinct($process.target.process.product_specific_process_id)
    $log_type = array_distinct(strings.concat($process.metadata.log_type,"/",$process.metadata.product_event_type))

  condition:
    $process
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule entra_id_login_activity_to_azure_ad_powershell_app {

  meta:
    author = "Google Cloud Security"
    description = "Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps"
    rule_id = "mr_5bce885a-7f65-41e1-ae94-9befc892d704"
    rule_name = "Entra ID Login Activity to Azure AD PowerShell Application"
    type = "hunt"
    platform = "azure"
    data_source = "azure ad"
    severity = "Medium"
    priority = "Medium"

  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.metadata.product_name = "Azure AD"
    $login.metadata.vendor_name = "Microsoft"
    $login.target.application = "Azure Active Directory PowerShell"
    $login.security_result.action = "ALLOW"
    $login.target.user.userid = $userid

  match:
    $userid over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($login.metadata.id)
    $target_application = array_distinct($login.target.application)
    $security_description = array_distinct($login.security_result.description)
    $security_summary = array_distinct($login.security_result.summary)
    $country_region_login_attempt = array_distinct(strings.concat($login.principal.location.city," ",$login.principal.location.state," ",$login.principal.location.country_or_region))
    $user_agent = array_distinct($login.network.http.user_agent)
    $principal_ip = array_distinct($login.principal.ip)

  condition:
    $login
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

 rule gcp_excessive_permission_denied_events {

  meta:
    author = "Google Cloud Security"
    description = "Detects excessive PermissionDenied events within an hour timeframe from a user"
    rule_id = "mr_2edbd86a-703a-41a3-b2b2-596dd9dbed8d"
    rule_name = "GCP Excessive Permission Denied Events"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "Cloud Infrastructure Discovery"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1580/"
    mitre_attack_version = "v14.1"
    type = "Alert"
    data_source = "GCP Cloud Audit"
    platform = "GCP"
    severity = "Low"
    priority = "Low"

 events:
    $gcp.metadata.log_type = "GCP_CLOUDAUDIT"
    $gcp.security_result.action = "BLOCK"
    $gcp.security_result.severity = "ERROR"
    $gcp.security_result.detection_fields["status_code"] = "7"
    $gcp.principal.user.userid = $user_id
    $gcp.target.application = $target_application
    $gcp.metadata.product_event_type = $product_event_type

  match:
    $user_id over 1h

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Discovery"
    $mitre_attack_technique = "Cloud Infrastructure Discovery"
    $mitre_attack_technique_id = "T1580"
    $event_count = count_distinct($gcp.metadata.id)
    $network_http_user_agent = array_distinct($gcp.network.http.user_agent)
    $principal_ip = array_distinct($gcp.principal.ip)
    $principal_ip_country = array_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($gcp.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = array_distinct($gcp.principal.user.user_display_name)
    $target_resource_name = array_distinct($gcp.target.resource.name)

  condition:
    #gcp > 5 and #target_application > 1 and #product_event_type > 1
}