Detection rules › Panther

Panther rules: gaia

Rule	Severity
GAIA GCPW Credential Theft Attack Chain	`high`

GAIA GCPW Credential Theft Attack Chain

Severity: high
Time window: 30h
Match by: p_alert_context.username_normalized
Tags: GAIA, Google Workspace, Windows, Credential Theft, Credential Dumping, GCPW
Reference: businessinsights.bitdefender.com
Source: github.com/panther-labs/panther-analysis

Detects the GAIA (Google Account Information and Authentication) credential theft attack chain: credential dumping tool execution on Windows followed by anomalous Google Workspace authentication. This pattern indicates an attacker has extracted OAuth refresh tokens from a Windows machine and is using them to authenticate to Google Workspace.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory
Lateral Movement	`T1550` Use Alternate Authentication Material

Rule specification

AnalysisType: correlation_rule
RuleID: "GAIA.Credential.Theft.Attack.Chain.Group"
DisplayName: "GAIA GCPW Credential Theft Attack Chain"
Enabled: false
Severity: High
Description: |
  Detects the GAIA (Google Account Information and Authentication) credential theft
  attack chain: credential dumping tool execution on Windows followed by anomalous Google
  Workspace authentication. This pattern indicates an attacker has extracted OAuth refresh
  tokens from a Windows machine and is using them to authenticate to Google Workspace.
Reports:
  MITRE ATT&CK:
    - TA0006:T1003 # Credential Access: OS Credential Dumping
    - TA0006:T1003.001 # Credential Access: LSASS Memory
    - TA0001:T1078.004 # Initial Access: Valid Accounts: Cloud Accounts
    - TA0006:T1550 # Credential Access: Use Alternate Authentication Material
Tags:
  - GAIA
  - Google Workspace
  - Windows
  - Credential Theft
  - Credential Dumping
  - GCPW
Reference: https://businessinsights.bitdefender.com/the-chain-reaction-new-methods-for-extending-local-breaches-in-google-workspace
Runbook: |
  1. Query Windows.EventLogs for all process creation events (EventID 4688 or 1) on the Computer hostname from the Windows alert in the 24 hours before and after the credential dump timestamp to identify the parent process, command line arguments, and any follow-on suspicious activity
  2. Query GSuite.ActivityEvent for all login and OAuth token events by the user_email from the Google alert in the 48 hours after the Windows credential dump timestamp to establish the full timeline of authentication activity and identify the anomalous_login_type and source ip_address fields
  3. Verify that p_alert_context.username_normalized from the Windows Credential Dumping Tool alert matches p_alert_context.username_normalized from the Google Workspace Login Type Anomaly alert, and calculate the time gap between p_alert_creation_time values to assess if the attack timeline is consistent with GAIA credential theft exploitation (typically within 6 hours)
Detection:
  - Group:
      - ID: Windows Credential Dump
        RuleID: Windows.Credential.Dumping.Tool
      - ID: Google Login Anomaly
        RuleID: Google.Workspace.Login.Type.Anomaly
    MatchCriteria:
      field_name:
        - GroupID: Windows Credential Dump
          Match: p_alert_context.username_normalized
        - GroupID: Google Login Anomaly
          Match: p_alert_context.username_normalized
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 10
    LookbackWindowMinutes: 1800

Stages and Predicates

Fires when the steps below all occur within 30h, correlated by p_alert_context.username_normalized. Each step needs one match unless a higher minimum is shown.

Stage 1: `step Windows Credential Dump`

References detection Windows Credential Dumping Tool.

Stage 2: `step Google Login Anomaly`

References detection Google Workspace Login Type Anomaly.

Response runbook

1. Query Windows.EventLogs for all process creation events (EventID 4688 or 1) on the Computer hostname from the Windows alert in the 24 hours before and after the credential dump timestamp to identify the parent process, command line arguments, and any follow-on suspicious activity

2. Query GSuite.ActivityEvent for all login and OAuth token events by the user_email from the Google alert in the 48 hours after the Windows credential dump timestamp to establish the full timeline of authentication activity and identify the anomalous_login_type and source ip_address fields

3. Verify that p_alert_context.username_normalized from the Windows Credential Dumping Tool alert matches p_alert_context.username_normalized from the Google Workspace Login Type Anomaly alert, and calculate the time gap between p_alert_creation_time values to assess if the attack timeline is consistent with GAIA credential theft exploitation (typically within 6 hours)