Cloud Credential Files Accessed by Process in Suspicious Directory

[rule]
description = """
Identifies an untrusted or unsigned process accessing cloud credential and configuration files. Adversaries may attempt
to access these files in order to gain access to sensitive data, laterally move or gain initial access into a cloud
environment.
"""
id = "caf1b0eb-ab71-4474-84cf-d7821ec0c292"
license = "Elastic License v2"
name = "Cloud Credential Files Accessed by Process in Suspicious Directory"
os_list = ["macos"]
version = "1.0.12"

query = '''
file where event.action == "open" and 
 file.path like~ ("/Users/*/.aws/*", "/Users/*/.config/gcloud/credentials.db", "/Users/*/.azure/*") and
 Effective_process.executable != null and
 (Effective_process.executable like~
                                 ("/Users/Shared/*",
                                  "/Users/*/Public/*",
                                  "/private/tmp/*",
                                  "/tmp/*",
                                  "/var/root/*",
                                  "/Library/WebServer/*",
                                  "/Library/Graphics/*",
                                  "/Library/Fonts/*",
                                  "/private/var/root/Library/HTTPStorages/*",
                                  "/private/var/root/Library/*") or
  process.executable like~ ("/Users/Shared/*",
                            "/Users/*/Public/*",
                            "/private/tmp/*",
                            "/tmp/*",
                            "/var/root/*",
                            "/Library/WebServer/*",
                            "/Library/Graphics/*",
                            "/Library/Fonts/*",
                            "/private/var/root/Library/HTTPStorages/*",
                            "/private/var/root/Library/*")) and
 not process.name like~ "python*" and
 not process.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*") and 
 not (process.executable like ("/private/tmp/claude-*/go-build*.test", "/private/tmp/*/.terraform/providers/registry.opentofu.org/hashicorp/aws/*/terraform-provider-aws") and file.name in ("credentials", "config")) and 
 not Effective_process.executable in ("/Applications/Cursor.app/Contents/MacOS/Cursor")
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.11.1"