Detect Masquerade Task or Service in Google Chronicle

rule masquerade_task_or_service_t1036_004 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects installation of Windows services with names mimicking legitimate Microsoft, Google, or Adobe services — MITRE ATT&CK T1036.004"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1036.004"
    reference = "https://attack.mitre.org/techniques/T1036/004/"
    false_positives = "Legitimate enterprise software with generic service names"

  events:
    $e.metadata.event_type = "SERVICE_MODIFICATION"
    $e.metadata.product_name = "Microsoft-Windows-Security-Auditing"
    (
      re.regex($e.target.resource.name,
        `(?i)(windows update security|microsoft network realtime|windows advanced task manager|google chrome security update|windows video service|windows power efficiency|system authorization service|windows management help|microsoft support|windows user service)`
      )
      or
      re.regex($e.target.resource.name,
        `(?i)(svchost|update|security|microsoft|google|chrome|adobe).*(service|task|helper|agent)`
      )
    )

  condition:
    $e
}