Detect Masquerading in Google Chronicle

rule t1036_masquerading_system_binary_wrong_path {
  meta:
    author = "df00tech"
    description = "Detects known Windows system binaries executing from non-standard file paths, indicative of masquerading (T1036)"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1036"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path != ""
    (
      re.regex($e.target.process.file.full_path, `(?i)\\svchost\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\csrss\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\lsass\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\services\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\smss\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\wininit\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\winlogon\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\explorer\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\spoolsv\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\taskhost\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\taskhostw\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\conhost\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\dllhost\.exe$`) or
      re.regex($e.target.process.file.full_path, `(?i)\\RuntimeBroker\.exe$`)
    )
    not re.regex($e.target.process.file.full_path, `(?i)^[Cc]:\\[Ww]indows\\[Ss]ystem32\\`)
    not re.regex($e.target.process.file.full_path, `(?i)^[Cc]:\\[Ww]indows\\[Ss]ys[Ww][Oo][Ww]64\\`)
    not re.regex($e.target.process.file.full_path, `(?i)^[Cc]:\\[Ww]indows\\[Ww]in[Ss][Xx][Ss]\\`)
    not re.regex($e.target.process.file.full_path, `(?i)^[Cc]:\\[Ww]indows\\[Ee]xplorer\.exe$`)

  condition:
    $e
}