Sensitive File Access - System Admin Utilities

[rule]
description = """
Identifies an unusual process accessing common third party system utilities sensitive files and registries. Adversaries
may search local file systems and remote file shares for files containing insecurely stored credentials.
"""
id = "949c72ee-a283-4673-afe0-7fa72bddc2f6"
license = "Elastic License v2"
name = "Sensitive File Access - System Admin Utilities"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
version = "1.0.30"

query = '''
sequence by process.entity_id with maxspan=5m
   [process where event.action == "start" and
    user.id like ("S-1-5-21*", "S-1-12-*") and process.executable : "?:\\*" and
    not process.executable :
          (
            /* third party programs common install path - requires local admin */
            "?:\\Program Files\\*",
            "?:\\Program Files (x86)\\*",
            /*
              dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
              explorer.exe for directory and file discovery.
              SearchProtocolHost.exe is for file searches and indexing.
             */
            "?:\\Windows\\explorer.exe",
            "?:\\Windows\\System32\\dllhost.exe",
            "?:\\Windows\\System32\\SearchProtocolHost.exe",
            "?:\\Windows\\regedit.exe",
            "?:\\Windows\\system32\\reg.exe",
            "?:\\Windows\\System32\\userinit.exe",
            "?:\\Windows\\System32\\notepad.exe",
            "?:\\Windows\\System32\\Robocopy.exe",
            "?:\\Windows\\System32\\cmd.exe",
            /* Windows Defender */
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe",
            "?:\\Windows\\_ScriptingFramework\\Modul\\Engine.exe",

            /* lot of legit access from mounted sysadmin file shares */
            "\\Device\\Mup\\*.exe") and
    not (process.code_signature.subject_name :
                      ("Martin Prikryl",
                       "OpenVPN Technologies, Inc.",
                       "TeamViewer Germany GmbH",
                       "Open Source Developer, Dominik Reichl",
                       "Tim Kosse",
                       "TEFINCOM S.A.",
                       "nordvpn s.a.") and
          process.code_signature.trusted == true)
   ]
   [any where event.category in ("registry", "file") and
    event.action in ("query", "open") and
    (
     file.path : ("?:\\Users\\*\\AppData\\Roaming\\KeePass\\KeePass.config.xml",
                  "?:\\Users\\*\\AppData\\*\\NordVPN\\NordVPN.exe*\\user.config",
                  "?:\\Users\\*\\AppData\\*\\FileZilla\\recentservers.xml",
                  "?:\\Users\\*\\AppData\\*\\FileZilla\\sitemanager.xml") or
     registry.path : ("HKEY_USERS\\S-1-5-21*\\software\\Martin Prikryl\\WinSCP *\\Sessions\\*\\Password*",
                      "HKEY_USERS\\S-1-5-21*\\SOFTWARE\\WOW6432Node\\TeamViewer\\ProxyPassword",
                      "HKEY_USERS\\S-1-5-21*\\Software\\OpenVPN-GUI\\Configs\\*auth-data*",
                      "HKEY_USERS\\S-1-12-1-*\\software\\Martin Prikryl\\WinSCP *\\Sessions\\*\\Password*",
                      "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\WOW6432Node\\TeamViewer\\ProxyPassword",
                      "HKEY_USERS\\S-1-12-1-*\\Software\\OpenVPN-GUI\\Configs\\*auth-data*")
     ) and
      /* unsigned KeePass */
     not (process.name : "KeePass.exe" and file.name : "KeePass.config.xml")]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"