Suspicious Vault Client Image Load

[rule]
description = """
Identifies when the Credential Vault Client library is loaded by an unusual process. Adversaries may acquire credentials
from Vault files.
"""
id = "048737fe-80d6-4462-aa80-ffeed853103e"
license = "Elastic License v2"
name = "Suspicious Vault Client Image Load"
os_list = ["windows"]
reference = [
    "https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.passwordvault.retrieve?view=winrt-22000",
]
version = "1.0.35"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  (
   (process.executable : "?:\\Windows\\Microsoft.NET\\*.exe" and
    not process.executable : "?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe") or

   (process.name : ("mshta.exe", "notepad.exe", "msbuild.exe", "regasm.exe", "notepad.exe") and
    not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "\\\\*")) or

   (process.name : "rundll32.exe" and process.args : "?:\\Users\\*\\AppData\\*" and
    not process.args : ("url.dll,FileProtocolHandler", "cryptext.dll,CryptExtOpen*",
                        "?:\\WINDOWS\\system32\\mshtml.dll,PrintHTML", "shdocvw.dll,OpenURL")) or

   (process.name : "rundll32.exe" and process.args_count == 1) or

   (process.name : "powershell.exe" and process.args : ("-enc", "-ec", "-e", "*downloadstring*", "*Reflection.Assembly*")) or

   (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*" and
    not (process.name : "setup*.exe" and process.code_signature.trusted == true)) or

   process.command_line : "\"{path}\""
   ) and 

   not (process.name : "powershell.exe" and
        process.parent.executable :
               ("?:\\Program Files (x86)\\Dell\\UpdateService\\ServiceShell.exe",
                "?:\\Windows\\System32\\wsl.exe",
                "?:\\Windows\\Explorer.exe")) and
   not (process.name : "ngen.exe" and process.parent.name : "NGenTask.exe") and 
   not (process.name : "notepad.exe" and process.parent.name : "explorer.exe") and 
   not (process.name : "calc.exe" and process.parent.executable : "?:\\Windows\\Explorer.exe") and
   not process.parent.executable : ("?:\\Program Files (x86)\\Lenovo\\LeAppStore\\LeASPac.exe",
                                    "?:\\Program Files\\Dell\\DellOptimizer\\DellOptimizer.exe",
                                    "?:\\Program Files\\WindowsApps\\Microsoft.*.exe",
                                    "?:\\Program Files (x86)\\LabTech Client\\LTClient.exe",
                                    "?:\\Users\\*\\AppData\\Local\\StarlimsBridge\\StarlimsBridge.exe",
                                    "?:\\ProgramData\\LogiShrd\\LogiOptions\\Software\\Current\\LogiOptionsMgr.exe",
                                    "?:\\Program Files\\LogiOptionsPlus\\logioptionsplus_agent.exe",
                                    "?:\\Program Files (x86)\\LogiOptionsPlus\\logioptionsplus_agent.exe",
                                    "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe", 
                                    "?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe",
                                    "C:\\Program Files\\Microsoft OneDrive\\OneDrive.exe",
                                    "C:\\Program Files\\Autodesk\\Desktop Connector\\DesktopConnector.Applications.Tray.exe") and
   not (process.executable : "?:\\Windows\\system32\\notepad.exe" and
        process.parent.executable :
                    ("C:\\Program Files*\\Google\\Chrome\\Application\\chrome.exe",
                     "C:\\Program Files*\\Microsoft\\Edge\\Application\\msedge.exe",
                     "C:\\Program Files*\\Microsoft Office\\root\\Office??\\OUTLOOK.EXE")) and
   not (process.name : ("powershell.exe", "mshta.exe", "cvtres.exe") and 
        process.working_directory : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*",  
                                     "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads\\")) and
   not process.executable :
              ("?:\\Program Files\\WindowsApps\\Microsoft.WindowsNotepad_*\\Notepad\\Notepad.exe",
               "?:\\Windows\\Microsoft.NET\\Framework*\\dw20.exe") and
   not (process.name : ("rundll32.exe", "regsvr32.exe") and 
       process.args : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", 
                       "C:\\Windows\\System32\\FirewallControlPanel.dll,ShowNotificationDialog",
                       "C:\\Windows\\System32\\rundll32.exe  C:\\Windows\\System32\\LogiLDA.dll,LogiFetch",
                       "C:\\Windows\\System32\\rundll32.exe  shell32.dll, ShellExec_RunDLL *",
                       "C:\\WINDOWS\\system32\\rundll32.exe  printui.dll,PrintUIEntryDPIAware*",
                       "cryptext.dll,CryptExtAddPFX")) and
   not (process.name : "rundll32.exe" and
        process.command_line :
                ("*MSI*.tmp*zzzzInvokeManagedCustomActionOutOfProc*",
                 "*\\AppData\\Local\\WebEx\\WebEx\\*\\atasctrl.dll,StartHostLauncher*",
                 "?:\\WINDOWS\\System32\\FirewallControlPanel.dll,ShowNotificationDialog")) and 
   not process.hash.sha256 : 
                 ("50d1713ef6353996d0fcb5548733e960b33bc220c2eccd3e4e1bff710c002610", 
                  "bea033e778048748eb1c87bf57597f7f5449b6a15bac55ddc08263c57f7a1ca8", 
                  "ced3768b028225aaf35bf7aa6efd5876751918c226a608b71494f521fbb242a9") and 
   not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\csc.exe" and process.parent.name : "powershell.exe" and 
        process.parent.command_line : "*\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\DataCollection*") and

   not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe" and
        process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe") and
   not (process.parent.executable : ("C:\\Windows\\System32\\sihost.exe", "C:\\Windows\\System32\\OpenWith.exe") and
        process.executable : "C:\\Windows\\System32\\notepad.exe" and process.args_count >= 2)
  ]
 [library where dll.name : "vaultcli.dll"]
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.4.0"