Detect GUI Input Capture in Google Chronicle

rule t1056_002_gui_input_capture_cred_dialog {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects GUI input capture via fake credential dialogs (T1056.002). Identifies PowerShell, MSHTA, WScript, or CScript processes invoking credential prompt APIs including Get-Credential, PromptForCredential, WinForms ShowDialog, and VBScript InputBox. Adversaries use these to harvest credentials through spoofed OS dialogs."
    technique = "T1056.002"
    tactic = "Collection, Credential Access"
    severity = "HIGH"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1056/002/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe)$/
    (
      $e.target.process.command_line = /(?i)(get-credential|promptforcredential|credphish|credential.prompt)/ or
      $e.target.process.command_line = /(?i)(system\.windows\.forms|showdialog|winforms|loadwithpartialname)/ or
      $e.target.process.command_line = /(?i)(inputbox|microsoft\.visualbasic|visualbasic\.interaction)/ or
      $e.target.process.command_line = /(?i)(osascript|dialogbox)/
    )

  condition:
    $e
}

rule t1056_002_gui_input_capture_suspicious_parent {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects GUI input capture (T1056.002) where credential prompt scripts are launched from high-risk parent processes such as Office applications or browsers, indicating potential drive-by or phishing delivery."
    technique = "T1056.002"
    tactic = "Collection, Credential Access"
    severity = "CRITICAL"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1056/002/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path = /(?i)(powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe)$/
    (
      $e.target.process.command_line = /(?i)(get-credential|promptforcredential|credphish)/ or
      $e.target.process.command_line = /(?i)(system\.windows\.forms|showdialog|loadwithpartialname)/ or
      $e.target.process.command_line = /(?i)(inputbox|microsoft\.visualbasic|visualbasic\.interaction)/
    )
    $e.principal.process.file.full_path = /(?i)(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|mshta\.exe|wscript\.exe|cscript\.exe|rundll32\.exe|regsvr32\.exe|chrome\.exe|firefox\.exe|msedge\.exe)$/

  condition:
    $e
}