Sensitive File Access by an Unsigned Process

[rule]
description = """
Identifies an unsigned process accessing sensitive files. Adversaries may attempt to discover and acquire credentials
from system files.
"""
id = "a05ce4c0-ce89-47ab-9ca0-ecf2b3a9e5a4"
license = "Elastic License v2"
name = "Sensitive File Access by an Unsigned Process"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.3"

query = '''
file where event.action == "open" and
 file.path : ("C:\\USERS\\*\\APPDATA\\*\\MICROSOFT\\PROTECT\\S-1-5-21*",
              "C:\\USERS\\*\\APPDATA\\*\\MICROSOFT\\PROTECT\\S-1-12-1*",
              "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Vault\\*-*",
              "C:\\Windows\\SysWOW64\\LogFiles\\SAM",
              "C:\\Windows\\System32\\config\\RegBack\\SAM",
              "C:\\Windows\\System32\\config\\RegBack\\SECURITY",
              "C:\\Windows\\System32\\config\\RegBack\\SYSTEM") and
 process.executable : ("C:\\*", "\\Device\\Mup\\*") and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and
 not file.name : ("desktop.ini", ".ignore", ".rgignore", "exclude", ".gitignore", ".fdignore") and
 not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
 not (process.name : "loki.exe" and file.extension : "vsch") and
 not (file.path : "C:\\Windows\\System32\\config\\RegBack\\SAM" and
      process.executable : ("C:\\ProgramData\\Guardicore\\utils\\osqueryd.exe", "C:\\ProgramData\\Guardicore\\utils\\gc-insight.exe"))
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"


[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.4.0"