Detect Process Injection in Google Chronicle

rule t1055_process_injection_high_value_target {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects process injection via CreateRemoteThread or high-privilege ProcessAccess targeting critical Windows processes (MITRE ATT&CK T1055)"
    mitre_attack_tactic = "Defense Evasion, Privilege Escalation"
    mitre_attack_technique = "T1055"
    severity = "HIGH"
    confidence = "MEDIUM"
    version = "1.0"

  events:
    (
      $e.metadata.event_type = "PROCESS_INJECTION" OR
      (
        $e.metadata.event_type = "PROCESS_OPEN" AND
        (
          $e.additional.fields["GrantedAccess"] = /0x1[Ff][0-9A-Fa-f]{4}/ OR
          $e.additional.fields["GrantedAccess"] = "0x1FFFFF" OR
          $e.additional.fields["GrantedAccess"] = "0x001F0FFF" OR
          $e.additional.fields["GrantedAccess"] = "0x143A"
        )
      )
    )
    NOT $e.principal.process.file.full_path = /(?i)(MsMpEng|csrss|services|svchost|lsass|wmiprvse)\.exe$/
    $e.target.process.file.full_path = /(?i)(lsass|csrss|winlogon|services|svchost|explorer|spoolsv)\.exe$/

  condition:
    $e
}