Detect Malicious Library in Google Chronicle

rule malicious_library_execution_t1204_005 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects malicious library execution via package manager install-time hooks spawning LOLBins, C2 callbacks from Python/Node on non-standard ports, and package runtimes dropping executables in sensitive paths. Covers supply chain compromise, typosquatting, and dependency confusion attacks (T1204.005)."
    mitre_attack_tactic = "Execution"
    mitre_attack_technique = "T1204.005"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1204/005/"

  events:
    // Branch 1: Package manager spawning suspicious child process
    (
      $branch1.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($branch1.principal.process.file.full_path, `(?i)(pip\.exe|pip3\.exe|python\.exe|python3\.exe|node\.exe|npm\.cmd)$`)
        or re.regex($branch1.principal.process.command_line, `(?i)(pip install|pip3 install|npm install|npm ci|yarn add|setup\.py)`)
      )
      and re.regex($branch1.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|msiexec\.exe|schtasks\.exe|at\.exe|sc\.exe|reg\.exe|net\.exe|netsh\.exe)$`)
    )
    or
    // Branch 2: Python/Node making C2 callback on non-standard port to public IP
    (
      $branch2.metadata.event_type = "NETWORK_CONNECTION"
      and re.regex($branch2.principal.process.file.full_path, `(?i)(python\.exe|python3\.exe|node\.exe)$`)
      and not net.ip_in_range_cidr($branch2.target.ip, "10.0.0.0/8")
      and not net.ip_in_range_cidr($branch2.target.ip, "172.16.0.0/12")
      and not net.ip_in_range_cidr($branch2.target.ip, "192.168.0.0/16")
      and not net.ip_in_range_cidr($branch2.target.ip, "127.0.0.0/8")
      and not re.regex($branch2.target.hostname, `(?i)(pypi\.org|pythonhosted\.org|npmjs\.com|github\.com|githubusercontent\.com|anaconda\.com|yarnpkg\.com|rubygems\.org|pkg\.go\.dev)$`)
      and $branch2.target.port != 80
      and $branch2.target.port != 443
      and $branch2.target.port != 8080
      and $branch2.target.port != 8443
    )
    or
    // Branch 3: Package runtime dropping executable or script in sensitive path
    (
      $branch3.metadata.event_type = "FILE_CREATION"
      and re.regex($branch3.principal.process.file.full_path, `(?i)(python\.exe|python3\.exe|node\.exe|pip\.exe|pip3\.exe)$`)
      and re.regex($branch3.target.file.full_path, `(?i)\.(exe|dll|bat|ps1|vbs|scr)$`)
      and re.regex($branch3.target.file.full_path, `(?i)(\\Startup\\|AppData\\Local\\Temp\\|Windows\\Temp\\|Windows\\System32\\|Windows\\SysWOW64\\|\\ProgramData\\)`)
    )

  condition:
    $branch1 or $branch2 or $branch3
}