Detect Remote System Discovery in Google Chronicle

rule t1018_remote_system_discovery {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Remote System Discovery (T1018) via known enumeration tools, suspicious command patterns, PowerShell-based host discovery, and AD computer enumeration."
    severity = "MEDIUM"
    priority = "MEDIUM"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1018"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1018/"
    false_positives = "IT admin tools, monitoring agents, AD management scripts"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname != ""

    (
      // Known enumeration tool names
      re.regex($e.target.process.file.full_path, `(?i)(\\|/)(net\.exe|net1\.exe|ping\.exe|arp\.exe|nbtstat\.exe|nltest\.exe|nmap(\.exe)?|masscan(\.exe)?|nbtscan(\.exe)?|ipscan(\.exe)?)$`)

      or

      // Net view and domain enumeration patterns
      re.regex($e.target.process.command_line, `(?i)net[\s\t]+(view|group)|net1[\s\t]+view|nltest.*(dclist|dsgetdc|domain_trusts|server)`)

      or

      // ARP cache and NetBIOS enumeration
      re.regex($e.target.process.command_line, `(?i)arp[\s\t]+(-a|/a)|nbtstat[\s\t]+(-a|-A|-n|-S)`)

      or

      // Ping sweep indicators
      re.regex($e.target.process.command_line, `(?i)(ping.*-n[\s\t]+1|for[\s\t]+/l.*ping|masscan|nbtscan)`)

      or

      // PowerShell-based discovery
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)(powershell\.exe|pwsh\.exe)$`)
        and
        re.regex($e.target.process.command_line, `(?i)(Get-ADComputer|Get-NetComputer|Invoke-Portscan|Test-Connection|Test-NetConnection|NetworkInformation\.Ping|\[Net\.Dns\]|Resolve-DnsName|ping -n 1)`)
      )

      or

      // External scanner tool execution
      re.regex($e.target.process.file.full_path, `(?i)(nmap|masscan|nbtscan|ipscan|angryip)(\.exe)?$`)
    )

    // Exclude known-benign parents
    not re.regex($e.principal.process.file.full_path, `(?i)(\\|/)(services\.exe|msiexec\.exe|sccm\.exe|ccmexec\.exe)$`)

  match:
    $e.principal.hostname over 5m

  outcome:
    $risk_score = max(
      if(re.regex($e.target.process.command_line, `(?i)net[\s\t]+(view|group)|net1[\s\t]+view`), 20) +
      if(re.regex($e.target.process.command_line, `(?i)nltest.*(dclist|dsgetdc|domain_trusts)`), 30) +
      if(re.regex($e.target.process.command_line, `(?i)arp[\s\t]+(-a|/a)`), 15) +
      if(re.regex($e.target.process.command_line, `(?i)nbtstat[\s\t]+(-a|-A|-n|-S)`), 15) +
      if(re.regex($e.target.process.command_line, `(?i)ping.*-n[\s\t]+1|masscan|nbtscan`), 25) +
      if(re.regex($e.target.process.command_line, `(?i)(Get-ADComputer|Get-NetComputer|Invoke-Portscan|NetworkInformation\.Ping)`), 30) +
      if(re.regex($e.target.process.file.full_path, `(?i)(nmap|masscan|nbtscan|ipscan)(\.exe)?$`), 35)
    )
    $hostname = $e.principal.hostname
    $username = $e.principal.user.userid
    $process_name = $e.target.process.file.full_path
    $command_line = $e.target.process.command_line

  condition:
    $e
}