Detect Exploitation for Credential Access in Google Chronicle

rule t1212_exploitation_for_credential_access {
  meta:
    author = "Argus Detection Platform"
    description = "Detects T1212 Exploitation for Credential Access: Kerberos RC4 TGS anomalies (MS14-068/golden ticket PAC forgery), Kerberos exploitation tool signatures (Mimikatz, impacket, PowerSploit), and high-privilege escalation on user accounts"
    severity = "CRITICAL"
    mitre_attack_technique = "T1212"
    mitre_attack_tactic = "Credential Access"
    confidence = "HIGH"
    version = "1.0"

  events:
    (
      /* Branch 1: Kerberos RC4 TGS Anomaly — EventID 4769 with RC4-HMAC targeting krbtgt */
      (
        $e.metadata.vendor_name = "Microsoft" and
        $e.metadata.product_event_type = "4769" and
        re.regex($e.target.resource.name, `(?i)^krbtgt`) and
        re.regex($e.extensions.auth.auth_details, `0x17`) and
        not re.regex($e.principal.user.userid, `\$`) and
        $e.principal.user.userid != "ANONYMOUS LOGON" and
        $e.principal.user.userid != ""
      )
      or
      /* Branch 2: Kerberos exploitation tool command line signatures */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        (
          re.regex($e.target.process.command_line, `(?i)kerberos::(golden|silver|ptc|ptt|purge|list)`) or
          re.regex($e.target.process.command_line, `(?i)ms14[-_]068`) or
          re.regex($e.target.process.command_line, `(?i)lsadump::(dcsync|lsa)`) or
          re.regex($e.target.process.command_line, `(?i)(Invoke-Kerberoast|Request-SPNTicket|Get-KerberosTicketGrantingTicket)`) or
          re.regex($e.target.process.command_line, `(?i)(goldenPac\.py|ticketer\.py)`) or
          re.regex($e.target.process.command_line, `(?i)sekurlsa::kerberos`) or
          re.regex($e.target.process.command_line, `(?i)PyKEK`)
        )
      )
      or
      /* Branch 3: High-privilege special logon — EventID 4672 with elevated tokens on user account */
      (
        $e.metadata.vendor_name = "Microsoft" and
        $e.metadata.product_event_type = "4672" and
        (
          re.regex($e.extensions.auth.auth_details, `SeDebugPrivilege`) or
          re.regex($e.extensions.auth.auth_details, `SeTcbPrivilege`) or
          re.regex($e.extensions.auth.auth_details, `SeAssignPrimaryTokenPrivilege`) or
          re.regex($e.extensions.auth.auth_details, `SeTakeOwnershipPrivilege`)
        ) and
        not re.regex($e.principal.user.userid, `\$`) and
        $e.principal.user.userid != "SYSTEM" and
        $e.principal.user.userid != "LOCAL SERVICE" and
        $e.principal.user.userid != "NETWORK SERVICE"
      )
    )

  condition:
    $e
}