Failed Attempts to Access Sensitive Files

[rule]
description = """
Identifies failed attempts to access common sensitive files and registries. Adversaries may search local file systems
and remote file shares for files containing insecurely stored credentials.
"""
id = "3163dd96-c677-4f1f-98bf-c8f3c81b197b"
license = "Elastic License v2"
name = "Failed Attempts to Access Sensitive Files"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
version = "1.0.31"

query = '''
any where event.category in ("registry", "file") and
   event.action in ("query", "open") and event.outcome == "failure" and process.pid != 4 and
   process.executable != null and
   (
    (file.path : "?:\\*" and
     file.path :
	     (
		  "?:\\Users\\*\\AppData\\Local\\*\\Remote Desktop Connection Manager\\RDCMan.settings",
		  "?:\\Users\\*\\AppData\\*\\NordVPN\\NordVPN.exe*\\user.config",
		  "?:\\Users\\*\\AppData\\*\\FileZilla\\recentservers.xml",
		  "?:\\Users\\*\\AppData\\*\\FileZilla\\sitemanager.xml") and
	 not process.executable :
	          ("?:\\Program Files\\*",
	           "?:\\Program Files (x86)\\*",
	           "?:\\Windows\\System32\\SearchProtocolHost.exe",
	           "?:\\Windows\\System32\\svchost.exe",
	           "?:\\Windows\\System32\\OpenSSH\\ssh.exe", 
	           "?:\\Windows\\System32\\OpenSSH\\ssh-keygen.exe",
	           "?:\\Windows\\System32\\OpenWith.exe", 
	           "\\Device\\Mup*",
	           "?:\\Windows\\explorer.exe",
	           "?:\\Windows\\eMweb\\certutil.exe") and
	 not (process.code_signature.subject_name :
	          ("Rapid7 LLC", "Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "Bitdefender SRL",
	           "McAfee, Inc.", "Serengeti Systems Incorporated", "nordvpn s.a.", "Kaspersky Lab", "JetBrains s.r.o.", 
	           "Illusive Networks LTD", "Ghisler Software GmbH", "Keeper Security Inc.", "Eric R. Zimmerman", 
	           "Galactic Advisors, Inc.", "Johannes Schindelin", "Mobatek", "Shift Technologies Inc.",
	           "Viber Media S.a r.l.", "ONELAUNCH TECHNOLOGIES INC.", "SAP SE") and
         process.code_signature.trusted == true) and
     not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
         user.id == "S-1-5-18" and process.code_signature.trusted == true) and
     not (file.name : "RDCMan.settings" and process.name : ("RDCMan.exe", "RDCMan-x86.exe"))
     ) or

	(registry.path :
         ("HKEY_USERS\\S-1-5-21*\\SOFTWARE\\WOW6432Node\\TeamViewer\\ProxyPassword", 
	  "HKEY_USERS\\S-1-5-21*\\Software\\OpenVPN-GUI\\Configs\\*auth-data*") and

	not (process.code_signature.trusted == true and
	     process.code_signature.subject_name :
	        ("Simon Tatham", "Tim Kosse", "David Sparer", "Martin Prikryl", "Open Source Developer, Sven Strickroth",
	         "Astrospark Technologies, LLC", "Solarwinds Worldwide, LLC", "NETSUPPORT LTD.", "Bitdefender SRL",
	         "Ivanti, Inc.", "Fortinet Technologies*", "Ivanti, Inc.")) and
	not process.executable : "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe")
    )
'''

min_endpoint_version = "8.6.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"


[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.6.0"