Sensitive File Access - Remote Desktop Connection Manager

[rule]
description = """
Identifies an unusual process accessing Remote Desktop Connection Manager settings file. Adversaries may search and
steal credentials from administration utilities configuration files.
"""
id = "934232e5-66d3-4e80-a4ee-a9f1b7d2a7bc"
license = "Elastic License v2"
name = "Sensitive File Access - Remote Desktop Connection Manager"
os_list = ["windows"]
reference = [
    "http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/",
    "https://smsagent.blog/2017/01/26/decrypting-remote-desktop-connection-manager-passwords-with-powershell/",
]
version = "1.0.33"

query = '''
file where event.type == "access" and event.outcome == "success" and
    /* domain user RID */
    user.id : ("S-1-5-21*", "S-1-12-*") and process.pid != 4 and
    file.path : "?:\\Users\\*\\AppData\\Local\\*\\Remote Desktop Connection Manager\\RDCMan.settings" and
    not process.executable :
                    ("?:\\Program Files (x86)\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.exe",
                     "?:\\Program Files\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.exe") and
    not (process.name : ("RDCMan.exe", "RDCMan-x86.exe", "RemoteDesktopManager.exe") and process.code_signature.subject_name like "Microsoft *" and process.code_signature.trusted == true) and
    not (process.code_signature.subject_name == "Fortinet, Inc." and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.0.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.001"
name = "Remote Desktop Protocol"
reference = "https://attack.mitre.org/techniques/T1021/001/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "8.0.0"