Suspicious Vault Files Access via RPC

[rule]
description = """
Identifies when an unusual process attempt to access the Windows Credential Vault files using RPC via the VaultSvc.
Adversaries may acquire credentials from Vault files.
"""
id = "e868a43a-9004-4aa0-951c-2d63252ac3d8"
license = "Elastic License v2"
name = "Suspicious Vault Files Access via RPC"
os_list = ["windows"]
reference = [
    "https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.passwordvault.retrieve?view=winrt-22000",
]
version = "1.0.17"

query = '''
sequence
 [process where event.action == "start" and
  not process.Ext.token.integrity_level_name == "system" and
  (
   ((process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
    (process.code_signature.trusted == false or process.code_signature.exists == false)) or

    (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB*") and not process.executable : "C:\\*") or

    (process.executable : ("?:\\Users\\Public\\*", "?:\\Windows\\Tasks\\*",
                           "?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*",
                           "?:\\Users\\*\\Downloads\\*", "?:\\Users\\*\\Desktop\\",
                           "?:\\Windows\\Temp\\*") and
    (process.code_signature.trusted == false or process.code_signature.exists == false)) or

    process.name : ("rundll32.exe", "regsvr32.exe", "powershell.exe", "wscript.exe", "cscript.exe") or

    process.executable : "?:\\Windows\\Microsoft.NET\\*.exe" or

    (process.executable regex~ """(c:\\windows\\system32\\[a-z0-9\-\_\.]+\.exe|c:\\windows\\syswow64\\[a-z0-9\-\_\.]+\.exe|c:\\windows\\[a-z0-9\-\_\.]+\.exe)""" and
     process.args_count <= 1) or

    process.parent.name : ("cmd.exe", "powershell.exe")
  ) and 
  not (process.executable : "?:\\Windows\\Explorer.exe" and
       process.parent.executable : ("?:\\Windows\\System32\\userinit.exe", "?:\\Windows\\System32\\winlogon.exe")) and
  not (process.name : "rundll32.exe" and
       process.args : ("?:\\WINDOWS\\sys*\\inetcpl.cpl,ClearMyTracksByProcess", "InetCpl.cpl,ClearMyTracksByProcess")) and
  not process.hash.sha256 : ("57fb008faeb05dd34fc1c224ce456b38ced950243fbac7f7cb348df68f990ebe", "56f291895ecc3f8ae647428f68d2e9de7fc81074a876dbfb24f9276c759e0675")
  ] by process.entity_id
 [file where event.action == "open" and process.name : "lsass.exe" and
  file.path : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Vault\\?*" and user.id : ("S-1-5-21*", "S-1-12-*") and
  Effective_process.name != null and not file.name : "desktop.ini"] by Effective_process.entity_id
  until [process where event.action:"end"] by process.entity_id
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.4.0"