Potential Discovery of Windows Credential Manager Store

[rule]
description = """
Identifies an unusual process accessing User or System Windows Credential Manager Files. Adversaries may attempt to list
and acquire credentials from the Windows Credential Manager.
"""
id = "cc60be0e-2c6c-4dc9-9902-e97103ff8df9"
license = "Elastic License v2"
name = "Potential Discovery of Windows Credential Manager Store"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.43"

query = '''
file where event.action == "open" and
 file.path : ("?:\\Users\\*\\AppData\\*\\Microsoft\\Credentials\\*",
              "?:\\Windows\\System32\\config\\systemprofile\\AppData\\*\\Microsoft\\Credentials\\*") and
 not file.name : ("desktop.ini", ".ignore", ".rgignore", "exclude", ".gitignore", ".fdignore") and
 not file.extension : "?*" and file.name != null and
 process.executable != null and
 user.id like ("S-1-5-21*", "S-1-12-*") and
 not process.executable :
           ("?:\\Program Files\\*",
            "?:\\Program Files (x86)\\*",
            "?:\\Windows\\System32\\lsass.exe",
            "?:\\Windows\\System32\\svchost.exe",
            "?:\\Windows\\System32\\Robocopy.exe",
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
            "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*.exe",
            "?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
            "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\*.exe",
            "?:\\Windows\\System32\\SearchIndexer.exe",
            "?:\\Windows\\System32\\control.exe",
            "System",
            "D:\\supergrate*.exe",
            "D:\\New folder\\SuperGrate\\*.exe",
            "?:\\Windows\\ccmcache\\*.exe",
            "?:\\WINDOWS\\CCM\\*.exe",
            "C:\\Source\\msert.exe",
            "?:\\Windows\\SysWOW64\\prevhost.exe",
            "?:\\Windows\\System32\\prevhost.exe",
            "?:\\Veritas\\NetBackup\\bin\\bpbkar32.exe",
            "?:\\Windows\\System32\\taskhostw.exe",
            "?:\\Windows\\System32\\taskhost.exe",
            "?:\\Windows\\System32\\sdiagnhost.exe",
            "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
            "?:\\Windows\\System32\\dllhost.exe",
            "?:\\Windows\\System32\\CompMgmtLauncher.exe",
            "?:\\Windows\\explorer.exe",
            "?:\\Windows\\System32\\MRT.exe",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
            "?:\\Windows\\Microsoft.NET\\Framework\\*\\csc.exe",
            "?:\\Windows\\System32\\SearchProtocolHost.exe",
            "?:\\Users\\*\\AppData\\Local\\ESET\\ESETOnlineScanner\\ESETOnlineScanner.exe",
            "\\Device\\Mup\\*",
            "D:\\*\\X64\\loadstate.exe",
            "\\Device\\HarddiskVolume?\\Windows\\System32\\*.exe",
            "\\Device\\HarddiskVolume?\\Windows\\SysWOW64\\*.exe") and
 not (process.code_signature.subject_name :
                        ("Big Angry Dog Ltd",
                         "Malwarebytes Inc",
                         "Malwarebytes Corporation",
                         "Nicholas Anderson",
                         "ForensiT Limited",
                         "Johannes Schindelin",
                         "ITPRODUCTDEV LTD",
                         "JAM Software GmbH",
                         "GRAPHISOFT SE",
                         "Anysphere, Inc.") and process.code_signature.trusted == true) and
 not process.thread.Ext.call_stack_summary in ("ntdll.dll|sophosed.dll|apphelp.dll|kernelbase.dll|migcore.dll|migstore.dll|migcore.dll|scanstate.exe|kernel32.dll|ntdll.dll",
                                               "ntdll.dll|sophosed.dll|apphelp.dll|kernelbase.dll|migcore.dll|loadstate.exe|kernel32.dll|ntdll.dll")
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.7.0"