Access to Windows Passwords Vault via Powershell

[rule]
description = """
Identifies access attempt to the Windows Passwords Vault via Powershell commands. Adversaries may acquire credentials
from Vault files.
"""
id = "7a4d1be2-db47-4545-a08c-9d4b20bad0d0"
license = "Elastic License v2"
name = "Access to Windows Passwords Vault via Powershell"
os_list = ["windows"]
reference = [
    "https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.passwordvault.retrieve?view=winrt-22000",
]
version = "1.0.29"

query = '''
process where event.action == "start" and
 process.pe.original_file_name == "PowerShell.EXE" and
 process.command_line : ("*Credentials.PasswordVault*", "*RetrievePassword*", "*Credentials*RetrieveAll*") and
 not process.parent.executable :
          ("?:\\Program Files\\WindowsApps\\KeeperSecurityInc.KeeperPasswordManager_*\\app\\keeperpasswordmanager.exe",
           "?:\\Program Files (x86)\\WindowsApps\\KeeperSecurityInc.KeeperPasswordManager_*\\app\\keeperpasswordmanager.exe") and
 not (process.parent.code_signature.subject_name == "Keeper Security Inc." and process.parent.code_signature.trusted == true)
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.0"