Detect LSA Secrets in Google Chronicle

rule lsa_secrets_dumping_t1003_004 {
  meta:
    author = "Detection Engineering"
    description = "Detects LSA Secrets dumping via unauthorized registry access, credential dump tools, or reg.exe SECURITY hive export"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1003.004"
    reference = "https://attack.mitre.org/techniques/T1003/004/"
    version = "1.0"

  events:
    (
      (
        $e.metadata.event_type = "REGISTRY_OPEN" or
        $e.metadata.event_type = "REGISTRY_READ"
      ) and
      re.regex($e.target.registry.registry_key, `(?i).*\\SECURITY\\Policy\\Secrets.*`) and
      not re.regex($e.principal.process.file.full_path, `(?i).*(\\lsass\.exe|\\svchost\.exe|\\services\.exe)$`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.target.process.command_line, `(?i)(lsadump::secrets|lsadump::cache|secretsdump|lsa_secrets|LSAsecret)`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.target.process.file.full_path, `(?i).*\\reg\.exe$`) and
      re.regex($e.target.process.command_line, `(?i).*save.*`) and
      re.regex($e.target.process.command_line, `(?i).*security.*`) and
      not re.regex($e.target.process.command_line, `(?i).*hklm\\\\system.*`)
    )

  condition:
    $e
}