Detect Token Impersonation/Theft in Google Chronicle

rule t1134_001_token_impersonation_theft {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects token impersonation and theft via privileged process handle acquisition, token manipulation tool execution, and high-risk privilege assignment to non-system accounts (MITRE ATT&CK T1134.001)"
    mitre_attack_technique = "T1134.001"
    mitre_attack_tactic = "Privilege Escalation, Defense Evasion"
    platform = "Windows"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"
    reference = "https://attack.mitre.org/techniques/T1134/001/"

  events:
    (
      /* Branch 1: PROCESS_OPEN to LSASS or other privileged Windows processes with token-capable access rights */
      (
        $e.metadata.event_type = "PROCESS_OPEN" and
        re.regex($e.target.process.file.full_path,
          `(?i)(\\lsass\.exe|\\winlogon\.exe|\\csrss\.exe|\\services\.exe|\\wininit\.exe)$`) and
        $e.target.process.access_mask in
          ("0x1010", "0x1fffff", "0x1f0fff", "0x143a", "0x0040", "0x40", "0x1410", "0x0002", "0x0004") and
        not re.regex($e.principal.process.file.full_path,
          `(?i)(\\MsMpEng\.exe|\\SenseIR\.exe|\\SenseCE\.exe|\\SecurityHealthService\.exe|\\csrss\.exe|\\smss\.exe|\\wininit\.exe|\\AzureADConnectAuthenticatio\.exe)$`)
      )
      or
      /* Branch 2: PROCESS_LAUNCH matching known token manipulation tool names or C2 framework post-exploitation CLI strings */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        (
          re.regex($e.target.process.file.full_path,
            `(?i)(\\incognito\.exe|\\tokenvator\.exe|\\tokenduplicator\.exe|\\token_manipulator\.exe)$`) or
          re.regex($e.target.process.command_line,
            `(?i)(steal_token|impersonate_token|Invoke-TokenManipulation|ImpersonateLoggedOnUser|DuplicateTokenEx|SetThreadToken|getsystem|rev2self|NtFilterToken|SeImpersonatePrivilege)`)
        )
      )
      or
      /* Branch 3: Windows Security EventID 4672 — high-risk impersonation or TCB privilege assigned to non-system interactive account */
      (
        $e.metadata.product_event_type = "4672" and
        (
          re.regex($e.extensions.auth.auth_details,
            `(?i)(SeImpersonatePrivilege|SeAssignPrimaryTokenPrivilege|SeTcbPrivilege|SeDebugPrivilege)`) or
          re.regex($e.target.user.attribute.labels.value,
            `(?i)(SeImpersonatePrivilege|SeAssignPrimaryTokenPrivilege|SeTcbPrivilege|SeDebugPrivilege)`)
        ) and
        not re.regex($e.principal.user.userid, `\$$`) and
        not $e.principal.user.userid in
          ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE", "ANONYMOUS LOGON")
      )
    )

  condition:
    $e
}