Detect Automated Exfiltration in Google Chronicle

rule T1020_AutomatedExfiltration_ScriptingEngine {
  meta:
    author = "Detection Engineering"
    description = "Detects scripting engines performing automated file collection and exfiltration via upload APIs or transfer tools"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1020"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(powershell\.exe|pwsh\.exe|python\.exe|python3\.exe|wscript\.exe|cscript\.exe|cmd\.exe)$/
    (
      re.regex($e.target.process.command_line, `(?i)(UploadFile|UploadData|UploadString|Start-BitsTransfer|Net\.FtpWebRequest|Invoke-WebRequest)`) or
      (
        re.regex($e.target.process.command_line, `(?i)(Get-ChildItem|Compress-Archive|dir\s/s|\[IO\.File\]::)`) and
        re.regex($e.target.process.command_line, `(?i)(curl\s|wget\s|ftp\s-|\ssftp\s)`)
      ) or
      (
        re.regex($e.target.process.command_line, `(?i)(Get-ChildItem|Compress-Archive|dir\s/s)`) and
        re.regex($e.target.process.command_line, `(?i)(\\Documents\\|\\Desktop\\|\\AppData\\|\\ProgramData\\)`)
      )
    )

  condition:
    $e
}

rule T1020_AutomatedExfiltration_TransferTool {
  meta:
    author = "Detection Engineering"
    description = "Detects known transfer utilities executing upload commands to external destinations — automated exfiltration indicator"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1020"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path = /(?i)(curl\.exe|wget\.exe|certutil\.exe|bitsadmin\.exe|ftp\.exe|sftp\.exe|scp\.exe)$/
    re.regex($e.target.process.command_line, `(?i)(-T\s|--upload-file|-d\s@|--data-binary\s@|/upload|/transfer|ftp://|sftp://|ftps://)`)
    not re.regex($e.target.process.command_line, `(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)`)

  condition:
    $e
}

rule T1020_AutomatedExfiltration_ArchiveThenNetwork {
  meta:
    author = "Detection Engineering"
    description = "Detects archive creation from sensitive paths followed within 5 minutes by external network connection from same host"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1020"
    severity = "CRITICAL"
    confidence = "MEDIUM"
    version = "1.0"

  events:
    $archive.metadata.event_type = "PROCESS_LAUNCH"
    $archive.target.process.file.full_path = /(?i)(7z\.exe|7za\.exe|winrar\.exe|rar\.exe|zip\.exe|tar\.exe)$/
    re.regex($archive.target.process.command_line, `(?i)(\\Documents|\\Desktop|\\Users|\\AppData|\\ProgramData|\\temp)`)
    $archive.principal.hostname = $host

    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.principal.hostname = $host
    not re.regex($net.target.ip, `^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)`)
    $net.metadata.event_timestamp.seconds > $archive.metadata.event_timestamp.seconds
    $net.metadata.event_timestamp.seconds < ($archive.metadata.event_timestamp.seconds + 300)

  condition:
    $archive and $net
}