Low Prevalence Hash On Process Launch Low Prevalence Domain Accessed

/*
 * Copyright 2023 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

rule low_prevalence_hash_on_process_launch_low_prevalence_domain_accessed {

  meta:
    author = "Google Cloud Security"
    description = "Detects when a low prevalence hash is seen during a process launch event, and a low prevalence domain is accessed within 10m."
    rule_id = "mr_0624f9fb-8c73-4b8c-8651-b88ed736c862"
    rule_name = "Low Prevalence Hash On Process Launch Low Prevalence Domain Accessed"
    type = "alert"
    tags = "prevalence"
    data_source = "zscalar, microsoft sysmon"
    severity = "Low"
    priority = "Low"

  events:
    // Process Launch
    $process.metadata.event_type = "PROCESS_LAUNCH"
    $process.principal.ip = $ip
    $process.target.file.sha256 != ""
    $process.target.file.sha256 = $sha256

    // File Prevalence Criteria
    $fileprev.graph.metadata.entity_type = "FILE"
    $fileprev.graph.metadata.source_type = "DERIVED_CONTEXT"
    $fileprev.graph.entity.file.prevalence.day_count = 10
    $fileprev.graph.entity.file.prevalence.rolling_max > 0
    //Adjust rolling_max for a different threshold as needed
    $fileprev.graph.entity.file.prevalence.rolling_max <= 2
    //Join process event to file prevalence entity
    $fileprev.graph.entity.file.sha256 = $sha256

    // Network HTTP
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.principal.ip = $ip
    $http.target.hostname = $hostname
    // Filter out URLs with RFC 1918 IP addresses
    not net.ip_in_range_cidr($http.target.ip, "127.0.0.1/32")
    not net.ip_in_range_cidr($http.target.ip, "10.0.0.0/8")
    not net.ip_in_range_cidr($http.target.ip, "172.16.0.0/12")
    not net.ip_in_range_cidr($http.target.ip, "192.168.0.0/16")
    // Only match valid FQDN, filter out background non-routable noise
    re.regex($http.target.hostname, `(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]`)

    // Domain Prevalence Criteria
    $domainprev.graph.metadata.entity_type = "DOMAIN_NAME"
    $domainprev.graph.metadata.source_type = "DERIVED_CONTEXT"
    $domainprev.graph.entity.domain.prevalence.day_count = 10
    $domainprev.graph.entity.domain.prevalence.rolling_max > 0
    // Adjust rolling_max for a different threshold as needed
    $domainprev.graph.entity.domain.prevalence.rolling_max < 2
    // Join network event to domain entity
    $domainprev.graph.entity.domain.name = $hostname

    // Apply timing element to force the process to occur before the http
    $process.metadata.event_timestamp.seconds <= $http.metadata.event_timestamp.seconds

  match:
    $ip over 10m

  outcome:
    $risk_score = max(
        // increment risk score based upon rolling_max prevalence
        if ( $domainprev.graph.entity.domain.prevalence.rolling_max >= 10, 10) +
        if ( $domainprev.graph.entity.domain.prevalence.rolling_max >= 2 and $domainprev.graph.entity.domain.prevalence.rolling_max <= 9 , 20) +
        if ( $domainprev.graph.entity.domain.prevalence.rolling_max = 1, 30)
    )
    // added to populate alert graph with additional context
    // Commented out principal.ip because it is already represented in graph as match variable. If match changes, can uncomment to add to results
    //$principal_ip = array_distinct($http.principal.ip)
    $target_ip = array_distinct($http.target.ip)
    $principal_process_pid = array_distinct($process.principal.process.pid)
    $principal_process_command_line = array_distinct($process.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($process.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
    $target_process_pid = array_distinct($process.target.process.pid)
    $target_process_command_line = array_distinct($process.target.process.command_line)
    $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
    $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
    $target_process_product_specific_process_id = array_distinct($process.target.process.product_specific_process_id)
    $principal_user_userid = array_distinct($process.principal.user.userid)
    $target_url = array_distinct($http.target.url)

  condition:
    $process and $fileprev and $http and $domainprev
}