Access to Windows Passwords Vault by Unusual Process

[rule]
description = """
Identifies access attempt to read the Windows Passwords Vault credentials by an unusual process. Adversaries may acquire
credentials from Vault files.
"""
id = "7ca8574b-b4f3-42c4-9314-521df1b4c942"
license = "Elastic License v2"
name = "Access to Windows Passwords Vault by Unusual Process"
os_list = ["windows"]
reference = [
    "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5382",
    "https://www.elastic.co/security-labs/detect-credential-access",
]
version = "1.0.7"

query = '''
any where event.category == "iam" and event.action in ("vault_credentials_read", "vault-credentials-were-read") and
 process.parent.executable != null and user.id != "S-1-5-18" and process.executable != null and
 (process.code_signature.trusted == false or
  process.code_signature.exists == false or
  process.code_signature.subject_name in ("Microsoft Corporation", "Microsoft Windows")) and
 not (process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.executable : "?:\\Windows\\*.exe") and
 not (process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\sppsvc.exe") and process.parent.executable : "?:\\Windows\\System32\\services.exe") and
 not (process.executable : "C:\\Windows\\System32\\msiexec.exe" and process.parent.executable : "C:\\Windows\\System32\\msiexec.exe") and
 not (process.name : "rundll32.exe" and process.command_line : "*inetcpl.cpl,ClearMyTracksByProcess*") and
 not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and process.parent.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")) and
 not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and process.parent.executable : ("?:\\Windows\\System32\\rundll32.exe", "?:\\Windows\\System32\\cmd.exe")) and
 not (process.executable : "?:\\Windows\\System32\\backgroundTaskHost.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
 not (process.executable : "C:\\Windows\\explorer.exe" and process.parent.executable : "C:\\Windows\\System32\\userinit.exe") and
 not process.executable :
                ("?:\\Program Files\\*.exe",
                 "?:\\Program Files (x86)\\*.exe",
                 "?:\\Windows\\System32\\conhost.exe",
                 "?:\\ProgramData\\Motorola Solutions\\Flex\\application\\FlexClient\\FlexClient.exe") and
 not process.parent.executable :
                           ("C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
                            "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
                            "C:\\Program Files\\WindowsApps\\KeeperSecurityInc.KeeperPasswordManager_*\\app\\keeperpasswordmanager.exe",
                            "C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\officesvcmgr.exe") and
 not (process.executable : ("C:\\Users\\*\\AppData\\Local\\PowerToys\\WinUI3Apps\\PowerToys.*.exe",
                            "C:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\\OneDriveActionHelper.exe",
                            "C:\\Users\\*\\AppData\\Local\\Microsoft\\Edge SxS\\Application\\msedge.exe") and
      process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.18.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.18.0"