Suspicious Access to Windows Vault Files

[rule]
description = """
Identifies an unusual process accessing Windows Vault files. Credential Lockers store credentials in encrypted .vcrd
files and the encryption key can be found in a file named Policy.vpol. Adversaries may acquire credentials from Vault
files.
"""
id = "831c1cda-8d8c-4c21-a84e-c428469e7d93"
license = "Elastic License v2"
name = "Suspicious Access to Windows Vault Files"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.30"

query = '''
file where event.action == "open" and
   /* Credentials History */
  (file.path : ("?:\\Users\\*\\AppData\\*\\Microsoft\\Vault\\*\\*", "?:\\ProgramData\\Microsoft\\Vault\\*") and
    file.extension : ("vpol", "vcrd")) and
  user.id : ("S-1-5-21*", "S-1-12-*") and process.executable : "?:\\*" and
  not (process.code_signature.subject_name : "Geek Squad (Best Buy Stores, L.P.)" and process.code_signature.status : "trusted") and
  /* third party programs and noisy native system processes */
  not process.executable :
          ("?:\\Program Files\\*",
           "?:\\Program Files (x86)\\*",
           "?:\\Windows\\System32\\lsass.exe",
           "?:\\Windows\\System32\\svchost.exe",
           "?:\\Windows\\System32\\Robocopy.exe",
           "?:\\Windows\\ccmcache\\*.exe",
           "?:\\Windows\\CCM\\*.exe",
           "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
           "?:\\Windows\\System32\\dllhost.exe",
           "?:\\Users\\*\\AppData\\Local\\ESET\\ESETOnlineScanner\\ESETOnlineScanner.exe",
           "?:\\Windows\\Explorer.exe",
           "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
           "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe",
           "?:\\Windows\\System32\\MRT.exe")
'''

min_endpoint_version = "8.0.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.0.0"