YARA-L rules: 21

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule lsass_process_memory_dump_file_creation_taskmgr {

  meta:
    author = "Swachchhanda Shrawan Poudel"
    description = "Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "LSASS Process Memory Dump Creation Via Taskmgr.exe"
    sigma_uuid = "69ca12af-119d-44ed-b50f-a47af0ebc364"
    sigma_status = "test"
    rule_id = "mr_d35a4d98-60fb-49bd-bb40-04d985c4e35b"
    tactic = "TA0006"
    technique = "T1003.001"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Rare case of troubleshooting by an administrator or support that has to be investigated regardless"

  events:
    $file.metadata.event_type = "FILE_CREATION"
    re.regex($file.principal.process.file.full_path, `:\\Windows\\(system32|SysWOW64)\\taskmgr\.exe$`) nocase
    (
        strings.contains(strings.to_lower($file.target.file.full_path), "\\appdata\\local\\temp\\") and
        strings.contains(strings.to_lower($file.target.file.full_path), "\\lsass") and
        re.regex($file.target.file.full_path, `\.dmp$`) nocase
    )
    $file.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($file.principal.user.userid = "user" and $file.principal.hostname = "hostname", 0, 15))
    $principal_hostname = array_distinct($file.principal.hostname)
    $principal_process_pid = array_distinct($file.principal.process.pid)
    $principal_process_command_line = array_distinct($file.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($file.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($file.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($file.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($file.principal.process.parent_process.product_specific_process_id)
    $principal_user_userid = array_distinct($file.principal.user.userid)
    $target_file_sha256 = array_distinct($file.target.file.sha256)
    $target_file_full_path = array_distinct($file.target.file.full_path)

  condition:
    $file
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule o365_onedrive_anonymous_filedownload {

  meta:
    author = "Google Cloud Security"
    description = "Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to download files from OneDrive."
    rule_id = "mr_f713e2b0-31b1-4165-8764-59a5e2c5eabb"
    rule_name = "O365 OneDrive Anonymous File Downloaded"
    tactic = "TA0010"
    technique = "T1048.002"
    type = "hunt"
    platform = "azure"
    data_source = "o365"
    severity = "Medium"
    priority = "Medium"

  events:
    $file.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
    $file.metadata.product_event_type = "FileDownloaded"
    $file.metadata.product_name = "Office 365"
    $file.metadata.vendor_name = "Microsoft"
    (
        $file.principal.user.userid = /^urn:spo:anon#/ or
        $file.principal.user.userid = "anonymous"
    )
    $file.principal.ip = $ip

  match:
    $ip over 5m

  outcome:
    $risk_score = 35
    $event_count = count_distinct($file.metadata.id)
    $referral_url = array_distinct($file.network.http.referral_url)
    $user_agent = array_distinct($file.network.http.user_agent)
    $principal_application = array_distinct($file.principal.application)
    $principal_ip = array_distinct($file.principal.ip)
    $target_application = array_distinct($file.target.application)
    $principal_user_userid = array_distinct($file.principal.user.userid)
    $src_file_full_path = array_distinct($file.src.file.full_path)
    $src_url = array_distinct($file.src.url)

  condition:
    $file
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule whois_expired_domain_executable_downloaded {

  meta:
    author = "Google Cloud Security"
    description = "Detect web traffic to a recently expired domain followed by an exe file creation event"
    rule_id = "mr_ce0a1979-ec95-40d4-8107-748ee6d1e93f"
    rule_name = "WHOIS Expired Domain Executable Downloaded"
    type = "alert"
    tags = "whois"
    data_source = "zscalar, microsoft sysmon"
    platform = "Windows"
    severity = "Low"
    priority = "Low"

  events:
    $access.metadata.event_type = "NETWORK_HTTP"
    $access.principal.hostname = $hostname
    $access.target.hostname = $domain

    // join access event to entity graph to use WHOIS data
    $whois.graph.entity.domain.name = $domain

    // Whois domains provided by GCTI Feed
    $whois.graph.metadata.entity_type = "DOMAIN_NAME"
    $whois.graph.metadata.vendor_name = "WHOIS"
    $whois.graph.metadata.product_name = "WHOISXMLAPI Simple Whois"
    $whois.graph.metadata.source_type = "GLOBAL_CONTEXT"
    // Filter out domains without expiration time
    $whois.graph.entity.domain.expiration_time.seconds > 0
    // Domain expired before the event
    $whois.graph.entity.domain.expiration_time.seconds < $access.metadata.event_timestamp.seconds

    // join access event with executable file creation event by principal hostname
    $creation.principal.hostname = $hostname
    $creation.metadata.event_type = "FILE_CREATION"
    $creation.target.file.full_path = /\.exe/ nocase

    // file creation comes after network event
    $creation.metadata.event_timestamp.seconds > $access.metadata.event_timestamp.seconds

  match:
    $hostname over 1h

  outcome:
    $risk_score = 20
    // added to populate alert graph with additional context
    // Commented out principal.hostname because it is already represented in graph as match variable. If match changes, can uncomment to add to results
    //$principal_hostname = array_distinct($access.principal.hostname)
    $target_hostname = array_distinct($access.target.hostname)
    $principal_process_pid = array_distinct($access.principal.process.pid)
    $principal_process_command_line = array_distinct($access.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($access.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($access.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($access.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($access.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($access.target.process.pid)
    $target_process_command_line = array_distinct($access.target.process.command_line)
    $target_process_file_sha256 = array_distinct($access.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($access.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($access.target.process.product_specific_process_id)
    $target_process_parent_process_product_specific_process_id = array_distinct($access.target.process.parent_process.product_specific_process_id)
    $principal_user_userid = array_distinct($access.principal.user.userid)
    $target_user_userid = array_distinct($access.target.user.userid)
    $target_url = array_distinct($access.target.url)
    $target_file_sha256 = array_distinct($creation.target.file.sha256)
    $target_file_full_path = array_distinct($creation.target.file.full_path)

  condition:
    $access and $whois and $creation
}