Detect Exfiltration Over Unencrypted Non-C2 Protocol in Google Chronicle

rule t1048_003_exfil_unencrypted_process {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects process launches matching FTP, HTTP upload, DNS tunneling, or SMTP exfiltration tool patterns for T1048.003"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048.003"
    severity = "HIGH"
    confidence = "MEDIUM"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.principal.process.file.full_path, `(?i)(ftp\.exe|winscp\.exe|filezilla\.exe|ncftp|lftp)`) or
      re.regex($e.principal.process.command_line, `(?i)(ftp://|ftps://|--ftp-upload|--upload-file|-T ftp|STOR )`) or
      (
        re.regex($e.principal.process.file.full_path, `(?i)(curl\.exe|wget\.exe|curl|wget)`) and
        re.regex($e.principal.process.command_line, `(?i)(--upload-file|--data-binary|--data @|-d @|--form|-F file)`) and
        re.regex($e.principal.process.command_line, `http://`)
      ) or
      re.regex($e.principal.process.file.full_path, `(?i)(dnscat|iodine|dns2tcp|dnstunnel)`) or
      re.regex($e.principal.process.command_line, `(?i)(dnscat|iodine|dns2tcp)`) or
      (
        re.regex($e.principal.process.file.full_path, `(?i)(blat\.exe|swaks|sendmail|msmtp)`) and
        re.regex($e.principal.process.command_line, `(?i)(-attach|--attach|-to |--to |-server)`)
      ) or
      (
        re.regex($e.principal.process.command_line, `(?i)(Send-MailMessage|smtp)`) and
        re.regex($e.principal.process.command_line, `(?i)(-attach|--attach|-to |--to |-server)`)
      )
    )

  condition:
    $e
}

rule t1048_003_plaintext_network_exfil {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects outbound network connections to unencrypted protocol ports from non-browser processes targeting external IPs — T1048.003"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048.003"
    severity = "MEDIUM"
    confidence = "MEDIUM"
    version = "1.0"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.target.port in (21, 25, 69, 80, 110, 143, 2121, 8080, 8000, 8888)
    not re.regex($e.target.ip, `^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)`)
    not re.regex($e.principal.process.file.full_path, `(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|svchost\.exe|services\.exe|lsass\.exe|MsMpEng\.exe)`)

  condition:
    $e
}