Detect Data from Network Shared Drive in Google Chronicle

rule t1039_data_from_network_shared_drive {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects data collection from network shared drives via bulk file access on UNC paths and execution of share enumeration or bulk copy tools. Covers APT28, RedCurl, Gamaredon, menuPass, Chimera, BRONZE BUTLER TTPs."
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1039"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1039/"
    severity = "HIGH"
    priority = "HIGH"

  events:
    // Signal A: Bulk copy/enumeration tool execution targeting UNC paths
    $e1.metadata.event_type = "PROCESS_LAUNCH"
    $e1.principal.hostname = $hostname
    $e1.principal.user.userid = $user
    (
      // net use / net view
      (
        re.regex($e1.target.process.file.full_path, `(?i)(\\|/)net(1)?\.exe$`) and
        re.regex($e1.target.process.command_line, `(?i)(use|view)`) and
        re.regex($e1.target.process.command_line, `\\\\[a-zA-Z0-9]`)
      ) or
      // robocopy, xcopy, forfiles
      (
        re.regex($e1.target.process.file.full_path, `(?i)(robocopy|xcopy|forfiles)\.exe$`) and
        re.regex($e1.target.process.command_line, `\\\\\\\\[a-zA-Z0-9]`)
      ) or
      // PowerShell bulk enumeration
      (
        re.regex($e1.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
        re.regex($e1.target.process.command_line, `\\\\\\\\[a-zA-Z0-9]`) and
        re.regex($e1.target.process.command_line, `(?i)(Get-ChildItem|Copy-Item|Get-Item|gci|\-Recurse)`)
      )
    )

    // Signal B: File creation/write on a UNC network path with sensitive extension
    $e2.metadata.event_type = "FILE_CREATION"
    $e2.principal.hostname = $hostname
    $e2.principal.user.userid = $user
    re.regex($e2.target.file.full_path, `^\\\\\\\\[^\\\\]+\\\\`)
    re.regex($e2.target.file.full_path, `(?i)\.(doc|docx|xls|xlsx|pdf|ppt|pptx|txt|csv|rtf|db|sql|kdbx|pfx|key|pem|conf|config|ini|bak|eml|msg|ost|pst)$`)

    // Correlate on same host and user within 2 hours
    $e1.metadata.event_timestamp.seconds <= $e2.metadata.event_timestamp.seconds + 7200
    $e1.metadata.event_timestamp.seconds >= $e2.metadata.event_timestamp.seconds - 7200

  condition:
    $e1 and $e2
}