Detect Ingress Tool Transfer in Google Chronicle

rule t1105_ingress_tool_transfer {
  meta:
    author = "df00tech"
    description = "Detects ingress tool transfer via LOLBin download utilities, PowerShell download cradles, and executables dropped in suspicious temporary paths by known download utilities. Covers certutil, bitsadmin, BITS, PowerShell WebClient methods, curl, wget, mshta, wscript, and related LOLBins."
    mitre_attack_tactic = "Command and Control"
    mitre_attack_technique = "T1105"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1105/"
    severity = "HIGH"
    confidence = "HIGH"
    rule_version = "1.0"
    yara_version = "YL2.0"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and
      (
        (
          re.regex($e.target.process.file.full_path, `(?i)(certutil|bitsadmin|mshta|desktopimgdownldr|esentutl|expand|extrac32|finger|ftp|ieexec|wscript|xcopy)\.exe$`)
          and re.regex($e.target.process.command_line, `(?i)(https?://|ftp://)`)
        )
        or
        (
          re.regex($e.target.process.file.full_path, `(?i)certutil\.exe$`)
          and re.regex($e.target.process.command_line, `(?i)(-urlcache|-decode|-decodehex|-verifyctl)`)
        )
        or
        (
          re.regex($e.target.process.file.full_path, `(?i)bitsadmin\.exe$`)
          and re.regex($e.target.process.command_line, `(?i)(/transfer|/addfile|/setnotifycmdline)`)
        )
        or
        (
          re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh|wscript|cscript)\.exe$`)
          and re.regex($e.target.process.command_line, `(?i)(invoke-webrequest|net\.webclient|downloadfile|downloaddata|downloadstring|start-bitstransfer|webclient|httpclient|webrequest\.create|openread)`)
          and re.regex($e.target.process.command_line, `(?i)https?://`)
        )
        or
        (
          re.regex($e.target.process.file.full_path, `(?i)(curl|wget)\.exe$`)
          and re.regex($e.target.process.command_line, `(?i)https?://`)
        )
      )
    )
    or
    (
      $e.metadata.event_type = "FILE_CREATION"
      and re.regex($e.target.file.full_path, `(?i)(\\temp\\|\\appdata\\local\\temp\\|\\appdata\\roaming\\|\\users\\public\\|\\programdata\\|\\windows\\temp\\)`)
      and re.regex($e.target.file.full_path, `(?i)\.(exe|dll|ps1|vbs|bat|cmd|hta|scr|bin|msi)$`)
      and re.regex($e.principal.process.file.full_path, `(?i)(certutil|bitsadmin|powershell|pwsh|curl|wget|mshta|wscript|cscript)\.exe$`)
    )

  condition:
    $e
}