YARA-L rules: 1m

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule aws_lateral_movement_using_iam_session_token {

  meta:
    author = "Google Cloud Security"
    description = "Detect when an IAM session token is created and used from a different IP."
    rule_id = "mr_ac0df875-fe5b-49af-bf2a-3da341177754"
    rule_name = "AWS Lateral Movement Using IAM Session Token"
    mitre_attack_tactic = "Lateral Movement"
    mitre_attack_technique = "Use Alternate Authentication Material"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1550/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "AWS CloudTrail"
    platform = "AWS"
    severity = "Low"
    priority = "Low"

  events:
    $accesskey.metadata.vendor_name = "AMAZON"
    $accesskey.metadata.product_name = "AWS CloudTrail"
    $accesskey.metadata.product_event_type = "GetSessionToken"
    $accesskey.security_result.action= "ALLOW"
    $accesskey.principal.user.userid = $p_userid

    $latmove.metadata.vendor_name = "AMAZON"
    $latmove.metadata.product_name = "AWS CloudTrail"

    //Different IP address and Same Temp Session Token used
    $accesskey.principal.ip != $latmove.principal.ip
    $latmove.additional.fields["accessKeyId"] != ""
    $accesskey.target.resource.product_object_id = $latmove.additional.fields["accessKeyId"]
    $accesskey.metadata.event_timestamp.seconds < $latmove.metadata.event_timestamp.seconds

  match:
    $p_userid over 1h

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Lateral Movement"
    $mitre_attack_technique = "Use Alternate Authentication Material"
    $mitre_attack_technique_id = "T1550"
    $event_count = count_distinct($latmove.metadata.id)
    $network_http_user_agent = array_distinct($latmove.network.http.user_agent)
    $principal_ip = array_distinct($latmove.principal.ip)
    $principal_ip_country = array_distinct($latmove.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($latmove.principal.ip_geo_artifact.location.state)
    $principal_user_display_name = array_distinct($latmove.principal.user.user_display_name)
    $dc_principal_user_display_name = count_distinct($latmove.principal.user.user_display_name)
    $is_mfa_used = array_distinct($latmove.extensions.auth.auth_details)
    $target_resource_name = array_distinct($latmove.target.resource.name)
    $target_resource_product_object_id = array_distinct($latmove.target.resource.product_object_id)
    $product_event_types = array_distinct($latmove.metadata.product_event_type)

  condition:
    $accesskey and $latmove
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_workspace_encryption_key_files_accessed_by_anonymous_user {

  meta:
    author = "Google Cloud Security"
    description = "Identifies when an encryption key file is accessed by an anonymous user in Google Drive. An adversary may attempt to access encryption keys before moving laterally and compromising sensitive data."
    rule_id = "mr_5d7defeb-13d4-48f3-b6b0-d2cdab30ab57"
    rule_name = "Google Workspace Encryption Key File Accessed By An Anonymous User"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "Unsecured Credentials: Private Keys"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1552/004/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "Medium"
    priority = "Medium"

  events:
    $ws.metadata.vendor_name = "Google Workspace"
    $ws.metadata.product_name = "drive"
    ($ws.metadata.product_event_type = "download" or
    $ws.metadata.product_event_type = "view" or
    $ws.metadata.product_event_type = "copy")

    ($ws.target.resource.attribute.labels["visibility"] = "people_with_link" or
    $ws.target.resource.attribute.labels["visibility"] = "public_on_the_web")
    $ws.target.resource.name = /.*token|.*assig|.*pssc|.*keystore|.*pub|.*pgp.asc|.*ps1xml|.*pem|.*gpg.sig|.*der|.*key|.*p7r|.*p12|.*asc|.*jks|.*p7b|.*signature|.*gpg|.*pgp.sig|.*sst|.*pgp|.*gpgz|.*pfx|.*crt|.*p8|.*sig|.*pkcs7|.*jceks|.*pkcs8|.*psc1|.*p7c|.*csr|.*cer|.*spc|.*ps2xml/

  outcome:
    $risk_score = max(35)
    $mitre_attack_tactic = "Credential Access"
    $mitre_attack_technique = "Unsecured Credentials: Private Keys"
    $mitre_attack_technique_id = "T1552.004"
    $event_count = count_distinct($ws.metadata.id)
    $product_event_type = $ws.metadata.product_event_type
    $userid = $ws.principal.user.userid
    $doc_type = $ws.src.resource.attribute.labels["doc_type"]
    $owner = $ws.target.resource.attribute.labels["owner"]
    $doc_name = $ws.target.resource.name
    //$doc_id = $ws.target.resource.product_object_id

  condition:
    $ws
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule o365_entra_id_app_permissions_percent_threshold_exceeded {

  meta:
    author = "Google Cloud Security"
    description = "Detects when an excessive number of permissions are assigned to an Entra ID application within a time window, potentially indicating a greedy permission grab, as a percentage from old permissions to new permissions"
    rule_id = "mr_6dcdb335-0054-46ae-a742-ecf6ac4e442b"
    rule_name = "O365 Entra ID App Permissions Percent Threshold Exceeded"
    assumption = "This rule does not compare the specific permissions of the old and new permissions. Removing 8 permissions and replacing with 8 different permissions would not cause this rule to trigger"
    reference = "https://learn.microsoft.com/en-us/graph/permissions-reference"
    type = "alert"
    platform = "azure"
    data_source = "o365"
    severity = "Medium"
    priority = "Medium"

  events:
    $app.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
    $app.metadata.product_name = "Office 365"
    $app.metadata.product_event_type = "Update application."
    $app.metadata.vendor_name = "Microsoft"
    $app.security_result.action = "ALLOW"
    (
      $app.target.resource.attribute.labels.key = /OldValue_EntitlementId-/ or
      $app.target.resource.attribute.labels.key = /NewValue_EntitlementId-/
    )
    $app.security_result.detection_fields["target_1"] = $app_name

  match:
    $app_name over 5m

  outcome:
    $risk_score = 65
    $event_count = count_distinct($app.metadata.id)
    $security_summary = array_distinct($app.security_result.summary)
    $user_agent = array_distinct($app.network.http.user_agent)
    $old_permissions = array_distinct(if($app.target.resource.attribute.labels.key = /OldValue_EntitlementId-/, $app.target.resource.attribute.labels.value, ""))
    $new_permissions = array_distinct(if($app.target.resource.attribute.labels.key = /NewValue_EntitlementId-/, $app.target.resource.attribute.labels.value, ""))
    /*
    Apps created via the portal come with a permission of user.read, however apps created via the Graph API do not. The first time permissions are added to an app created via the API,
    the distinct count for new permissions will be off by one. Subsequent events will reflect the correct counts of old and new permissions.
    */
    $old_permissions_count = count_distinct(if($app.target.resource.attribute.labels.key = /OldValue_EntitlementId-/, $app.target.resource.attribute.labels.value, "")) - 1
    $new_permissions_count = count_distinct(if($app.target.resource.attribute.labels.key = /NewValue_EntitlementId-/, $app.target.resource.attribute.labels.value, "")) - 1
    //calculate the difference between the old and new permissions within the match window
    $old_permission_zero_handler = if($old_permissions_count = 0, 1, $old_permissions_count)
    $permission_change_percentage = (($new_permissions_count - $old_permission_zero_handler) / $old_permission_zero_handler) * 100
    //added to populate alert graph with additional context
    $principal_user_userid = array_distinct($app.principal.user.userid)

  condition:
    $app and $permission_change_percentage > 70
}