Sensitive File Access - Cloud Credentials

[rule]
description = """
Identifies an unusual process accessing common cloud providers credential files. Adversaries may search local file
systems and remote file shares for files containing insecurely stored credentials.
"""
id = "39f60a36-8c5a-4703-8576-ad3e8c800a0f"
license = "Elastic License v2"
name = "Sensitive File Access - Cloud Credentials"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt"]
version = "1.0.35"

query = '''
sequence by process.entity_id with maxspan=5m
   [process where event.action == "start" and
    user.id like ("S-1-5-21*", "S-1-12-*") and process.executable != null and 
    not (process.code_signature.subject_name : ("Johannes Schindelin", "Anaconda, Inc.") and process.code_signature.status == "trusted") and
    not (process.code_signature.subject_name : "Python Software Foundation" and
         process.executable : "?:\\Users\\*\\AppData\\Local\\Google\\Cloud SDK\\google-cloud-sdk\\platform\\bundledpython\\python.exe") and
    not process.executable :
          (
            /* third party programs common install path - requires local admin */
            "?:\\Program Files\\*",
            "?:\\Program Files (x86)\\*",

            /*
              dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
              explorer.exe for directory and file discovery.
              SearchProtocolHost.exe is for file searches and indexing.
             */
            "?:\\Windows\\explorer.exe",
            "?:\\Windows\\System32\\dllhost.exe",
            "?:\\Windows\\System32\\SearchProtocolHost.exe",

            /* Windows Defender */
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe") and
    process.hash.sha256 != "0a8876ede7d2b65a5a0443831b2b4757d3519396a22bd55c20102bc67e6d16b3"]
   [file where event.type == "access" and
    /* non system accounts */
    user.id like ("S-1-5-21*", "S-1-12-*") and

    /* AWS/Google/Azure/Git cloud credential files */
    file.path : ("?:\\users\\*\\AppData\\*\\gcloud\\credentials.db",
                 "?:\\users\\*\\AppData\\*\\gcloud\\legacy_credentials",
                 "?:\\users\\*\\AppData\\*\\gcloud\\access_tokens.db",
                 "?:\\users\\*\\.azure\\accessTokens.json",
                 "?:\\users\\*\\.azure\\azureProfile.json",
                 "?:\\users\\*\\.azure\\msal_token_cache.json",
                 "?:\\users\\*\\.azure\\msal_token_cache.bin",
                 "?:\\users\\*\\.azure\\msal_http_cache.bin",
                 "?:\\users\\*\\.aws\\credentials",
                 "?:\\Users\\*\\.config\\git\\credentials")]
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"