Sensitive File Access - SSH Saved Keys

[rule]
description = """
Identifies an unusual process accessing common SSH clients saved SSH keys. Adversaries may search local file systems and
remote file shares for files containing insecurely stored credentials.
"""
id = "1487d726-2bd2-4a9e-a9d2-db8aef1d6239"
license = "Elastic License v2"
name = "Sensitive File Access - SSH Saved Keys"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
version = "1.0.38"

query = '''
any where event.category in ("registry", "file") and
 event.action in ("query", "open") and
 user.id like ("S-1-5-21*", "S-1-12-*") and process.executable : "C:\\*" and
 (file.path : "?:\\Users\\*\\.ssh\\known_hosts" or
  registry.path :
        ("HKEY_USERS\\S-1-5-21*\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\*",
         "HKEY_USERS\\S-1-12-1-*\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\*")) and
  not process.executable :
      ("?:\\Program Files\\*",
	   "?:\\Program Files (x86)\\*", 
	   "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", 
	   "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe",
	   "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe",
	   "?:\\Windows\\System32\\OpenSSH\\*.exe", 
	   "?:\\Windows\\System32\\smartscreen.exe", 
	   "?:\\WINDOWS\\system32\\reg.exe", 
	   "?:\\Windows\\regedit.exe", 
	   "?:\\Windows\\System32\\notepad.exe", 
	   "?:\\Windows\\System32\\Robocopy.exe",
	   "?:\\Windows\\System32\\cmd.exe",
	   "?:\\Windows\\explorer.exe",
       "?:\\Windows\\System32\\mmc.exe",
	   "?:\\Windows\\System32\\svchost.exe",
	   "?:\\$WINDOWS.~BT\\Sources\\setuphost.exe",
	   "?:\\Users\\*\\AppData\\Local\\Programs\\Git\\mingw64\\bin\\git.exe",
	   "?:\\Users\\*\\AppData\\Local\\DBeaver\\dbeaver.exe",
	   "?:\\Users\\*\\Tools\\dbeaver\\dbeaver.exe",
	   "?:\\Windows\\System32\\SearchProtocolHost.exe",
	   "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
	   "?:\\ProgramData\\GalacticScan\\GalacticScan.exe",
	   "?:\\Users\\*\\AppData\\Local\\Programs\\GalacticScan\\GalacticScan_Warpspeed.exe",
	   "?:\\Users\\*\\AppData\\Local\\Postman\\app-*\\Postman.exe",
	   "?:\\Users\\*\\OneDrive\\*\\Wintriage\\Tools\\ADSecurizame.exe",
	   "?:\\Users\\*\\AppData\\Local\\JetBrains\\Toolbox\\apps\\Gateway\\*\\bin\\gateway64.exe",
	   "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
	   "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\*\\@vscode\\ripgrep\\bin\\rg.exe",
	   "?:\\programs\\!_local\\SmartGit\\bin\\smartgit.exe",
	   "?:\\Windows\\System32\\dllhost.exe",
	   "?:\\Windows\\System32\\OpenWith.exe",
	   "?:\\Windows\\System32\\userinit.exe", 
	   "C:\\OSGeo4W64\\bin\\qgis-ltr-bin.exe",
	   "C:\\Users\\*\\Anaconda3\\pythonw.exe") and

  /* many of the following exclusions are not signed nor have an original file name  */
  not process.name : ("pscp.exe", "psftp.exe", "_ssh.exe", "plink.exe", "PuTTYNG.exe", "putty*.exe", "busybox.exe",
                      "ssh.exe", "WinSCP.exe", "bash.exe", "MoTTY.exe", "eclipse.exe", "code.exe", "datagrip*.exe",
                      "MobaXterm_Personal*.exe", "RoyalTS_PuTTY*.exe", "MAP.EXE", "rssputty.exe", "phpstorm64.exe",
                      "Fork.exe", "fzsftp.exe", "OneDrive.exe") and
  not (process.code_signature.subject_name :
               ("Galactic Advisors, Inc.", "Simon Tatham", "Atlassian Pty Ltd", "Emsisoft Limited", "JetBrains s.r.o.",
                "ESET, spol. s r.o.", "Notepad++", "Open Source Developer, Sven Strickroth", "ShowMyPC", "AXOSOFT, LLC",
                "General Services Administration", "ShowMyPC INC", "Oracle America, Inc.", "CS.DISA-RE11.08-0031", "Mobatek", 
		"DBeaver Corp", "Eclipse.org Foundation, Inc.", "Shadow", "The Qt Company Oy", "Anysphere, Inc.", "International Business Machines Corporation") and
       process.code_signature.status in ("trusted", "errorChaining")) and
  process.thread.Ext.call_stack_summary != "ntdll.dll|cygwin1.dll"
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.004"
name = "SSH"
reference = "https://attack.mitre.org/techniques/T1021/004/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "8.7.0"