Detect OS Credential Dumping in Google Chronicle

rule T1003_OS_Credential_Dumping {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1003 OS Credential Dumping via known tools, suspicious arguments, LSASS access, and comsvcs MiniDump"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1003"
    severity = "CRITICAL"
    priority = "HIGH"
    version = "1.0"

  events:
    (
      // Branch 1: Known credential dumping tool names in process events
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      (
        re.regex($e.principal.process.file.full_path,
          `(?i)(mimikatz|mimilib|mimidrv|procdump64?|wce\.exe|pwdump|fgdump|gsecdump|cachedump|lsadump|lazagne|nanodump|handlekatz|sharpdump|sharpkatz|safetydump)`)
        or
        re.regex($e.target.process.command_line,
          `(?i)(mimikatz|mimilib|procdump|wce\.exe|pwdump|fgdump|gsecdump|cachedump|lsadump|lazagne|nanodump|handlekatz|sharpdump|sharpkatz|safetydump)`)
      )
    )
    or
    (
      // Branch 2: Suspicious credential-harvesting arguments
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.target.process.command_line,
        `(?i)(sekurlsa|lsadump|dcsync|logonpasswords|wdigest|privilege::debug|token::elevate|ntds\.dit|comsvcs.*minidump|out-minidump|pypykatz|volatility)`)
    )
    or
    (
      // Branch 3: LSASS process access from unauthorized process
      $e.metadata.event_type = "PROCESS_OPEN" and
      re.regex($e.target.process.file.full_path, `(?i)lsass\.exe`) and
      not re.regex($e.principal.process.file.full_path,
        `(?i)(msmpeng|svchost|csrss|wininit|system|taskmgr|services)`)
    )
    or
    (
      // Branch 4: rundll32 + comsvcs + MiniDump (comsvcs minidump technique)
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.principal.process.file.full_path, `(?i)rundll32\.exe`) and
      re.regex($e.target.process.command_line, `(?i)comsvcs`) and
      re.regex($e.target.process.command_line, `(?i)minidump`)
    )
    or
    (
      // Branch 5: Registry access to credential hives
      $e.metadata.event_type = "REGISTRY_MODIFICATION" and
      re.regex($e.target.registry.registry_key,
        `(?i)HKLM\\(SAM|SECURITY|SYSTEM)`) and
      not re.regex($e.principal.process.file.full_path,
        `(?i)(regedit|svchost|services|system)`)
    )

  condition:
    $e
}