YARA-L rules: 2s

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

 rule gcp_iam_organization_policy_updated_or_deleted {

  meta:
    author = "Google Cloud Security"
    description = "Detect when GCP IAM Organization Policy is updated or deleted."
    rule_id = "mr_327c1753-1cd5-424a-8a9f-1648278e2831"
    rule_name = "GCP IAM Organization Policy Updated Or Deleted"
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "Account Manipulation"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1098/"
    mitre_attack_version = "v14.1"
    type = "Alert"
    data_source = "GCP Cloud Audit"
    platform = "GCP"
    severity = "High"
    priority = "High"

  events:
    $gcp.metadata.log_type = "GCP_CLOUDAUDIT"
    (
        ($gcp.metadata.event_type = "RESOURCE_WRITTEN" and $gcp.metadata.product_event_type = "google.cloud.orgpolicy.v2.OrgPolicy.UpdatePolicy") or
        ($gcp.metadata.event_type = "RESOURCE_DELETION" and $gcp.metadata.product_event_type = "google.cloud.orgpolicy.v2.OrgPolicy.DeletePolicy")
    )
    $gcp.security_result.action = "ALLOW"
    $gcp.target.application = "orgpolicy.googleapis.com"

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Persistence, Privilege Escalation"
    $mitre_attack_technique = "Account Manipulation"
    $mitre_attack_technique_id = "T1098"
    $event_count = count_distinct($gcp.metadata.id)
    $network_http_user_agent = array_distinct($gcp.network.http.user_agent)
    $principal_ip = array_distinct($gcp.principal.ip)
    $principal_ip_country = array_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($gcp.principal.ip_geo_artifact.location.state)
    $principal_user_id = $gcp.principal.user.userid
    $principal_user_display_name = $gcp.principal.user.user_display_name
    $target_resource_name = $gcp.target.resource.name
    $event_name = $gcp.metadata.product_event_type

  condition:
    $gcp
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

 rule gcp_workload_identity_pool_disabled_or_deleted {

  meta:
    author = "Google Cloud Security"
    description = "Detect when GCP Workload identity pools are disabled or deleted. Disabling or deleting a pool will prevent any connected identities from accessing all GCP resources."
    rule_id = "mr_265fbe68-80c6-48b0-a211-dca6bcef0fd2"
    rule_name = "GCP Workload Identity Pool Disabled Or Deleted"
    mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    mitre_attack_technique = "Valid Accounts: Cloud Accounts"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1078/004/"
    mitre_attack_version = "v14.1"
    type = "Alert"
    data_source = "GCP Cloud Audit"
    platform = "GCP"
    severity = "High"
    priority = "High"

  events:
    $gcp.metadata.log_type = "GCP_CLOUDAUDIT"
    (
        $gcp.metadata.product_event_type = "google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool" or
        (
            $gcp.metadata.product_event_type = "google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool" and
            $gcp.target.resource.attribute.labels["req_identityPool_disabled"] = "true"
        )
    )
    $gcp.target.application = "iam.googleapis.com"
    $gcp.security_result.action = "ALLOW"

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Defense Evasion, Persistence, Privilege Escalation, Initial Access"
    $mitre_attack_technique = "Valid Accounts: Cloud Accounts"
    $mitre_attack_technique_id = "T1078.004"
    $event_count = count_distinct($gcp.metadata.id)
    $network_http_user_agent = array_distinct($gcp.network.http.user_agent)
    $principal_ip = array_distinct($gcp.principal.ip)
    $principal_ip_country = array_distinct($gcp.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($gcp.principal.ip_geo_artifact.location.state)
    $principal_user_id = $gcp.principal.user.userid
    $principal_user_display_name = $gcp.principal.user.user_display_name
    $target_resource_name = $gcp.target.resource.name
    $event_name = $gcp.metadata.product_event_type

  condition:
    $gcp
}

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule google_workspace_multiple_files_copied_from_google_drive {

  meta:
    author = "Google Cloud Security"
    description = "Identifies when a user copies multiple files from Google Drive, which may indicate data exfiltration."
    rule_id = "mr_dc187a73-9ea0-47bf-9a78-9a6f915de0f0"
    rule_name = "Google Workspace Multiple Files Copied From Google Drive"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "Exfiltration Over Web Service"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1567/"
    mitre_attack_version = "v13.1"
    type = "Alert"
    data_source = "Workspace Activity"
    severity = "High"
    priority = "High"

  events:
    $ws.metadata.vendor_name = "Google Workspace"
    $ws.metadata.product_name = "drive"
    (
        $ws.metadata.product_event_type = "copy" or
        $ws.metadata.product_event_type = "source_copy"
    )
    $ws.principal.user.userid = $user_id

  match:
    $user_id over 1h

  outcome:
    $risk_score = max(75)
    $mitre_attack_tactic = "Exfiltration"
    $mitre_attack_technique = "Exfiltration Over Web Service"
    $mitre_attack_technique_id = "T1567"
    $event_count = count_distinct($ws.metadata.id)
    $product_event_type = array_distinct($ws.metadata.product_event_type)
    $userid = array_distinct($ws.principal.user.userid)
    $doc_type = array_distinct($ws.src.resource.attribute.labels["doc_type"])
    $owner = array_distinct($ws.target.resource.attribute.labels["owner"])
    $doc_name = array_distinct($ws.target.resource.name)
    $doc_id = array_distinct($ws.target.resource.product_object_id)
    $count_docs = count_distinct($ws.target.resource.product_object_id)

  condition:
    // Customize the value of $count_docs to set the alerting threshold for your environment
    $ws and $count_docs > 10
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule hacktool_mimikatz_execution {

  meta:
    author = "Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton"
    description = "Detection well-known mimikatz command line arguments"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_mimikatz_command_line.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "HackTool - Mimikatz Execution"
    sigma_uuid = "a642964e-bead-4bed-8910-1bb4d63e3b4d"
    sigma_status = "test"
    rule_id = "mr_d173bc90-2dcf-418d-a40c-bb7792f6300a"
    tactic = "TA0006"
    technique = "T1003.001"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Unlikely"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    (
        strings.contains(strings.to_lower($process.target.process.command_line), "dumpcreds") or
        strings.contains(strings.to_lower($process.target.process.command_line), "mimikatz") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::aadcookie") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::detours") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::memssp") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::mflt") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::ncroutemon") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::ngcsign") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::printnightmare") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::skeleton") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::preshutdown") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::mstsc") or
        strings.contains(strings.to_lower($process.target.process.command_line), "::multirdp") or
        strings.contains(strings.to_lower($process.target.process.command_line), "rpc::") or
        strings.contains(strings.to_lower($process.target.process.command_line), "token::") or
        strings.contains(strings.to_lower($process.target.process.command_line), "crypto::") or
        strings.contains(strings.to_lower($process.target.process.command_line), "dpapi::") or
        strings.contains(strings.to_lower($process.target.process.command_line), "sekurlsa::") or
        strings.contains(strings.to_lower($process.target.process.command_line), "kerberos::") or
        strings.contains(strings.to_lower($process.target.process.command_line), "lsadump::") or
        strings.contains(strings.to_lower($process.target.process.command_line), "privilege::") or
        strings.contains(strings.to_lower($process.target.process.command_line), "process::") or
        strings.contains(strings.to_lower($process.target.process.command_line), "vault::")
    )
    $process.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($process.principal.user.userid = "user" and $process.principal.hostname = "hostname", 0, 15))
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specfic_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specfic_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specfic_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)
    $log_type = array_distinct(strings.concat($process.metadata.log_type,"/",$process.metadata.product_event_type))

  condition:
    $process
}