Detect Software Discovery in Google Chronicle

rule t1518_software_discovery {
  meta:
    author = "df00tech"
    description = "Detects software discovery activity via WMI, registry, PowerShell, and cross-platform package manager enumeration (MITRE ATT&CK T1518)"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1518"
    severity = "MEDIUM"
    priority = "MEDIUM"
    created = "2026-04-21"
    platforms = "Windows, Linux, macOS"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname
    $e.principal.process.file.full_path = $parent_path
    $e.target.process.file.full_path = $proc_path
    $e.target.process.command_line = $cmdline

    // Match software discovery patterns across tools
    (
      // wmic.exe product enumeration
      (
        re.regex($proc_path, `(?i).*\\wmic\.exe$`) and
        (
          re.regex($cmdline, `(?i)product\s+(get|list|where)`) or
          strings.contains(strings.to_lower($cmdline), "win32_product")
        )
      ) or
      // reg.exe targeting Uninstall keys
      (
        re.regex($proc_path, `(?i).*\\reg\.exe$`) and
        strings.contains(strings.to_lower($cmdline), "uninstall")
      ) or
      // PowerShell software discovery
      (
        re.regex($proc_path, `(?i).*(powershell|pwsh)\.exe$`) and
        (
          strings.contains(strings.to_lower($cmdline), "get-package") or
          strings.contains(strings.to_lower($cmdline), "win32_product") or
          strings.contains(strings.to_lower($cmdline), "win32_installedwin32program") or
          strings.contains(strings.to_lower($cmdline), "get-wmiobject") or
          strings.contains(strings.to_lower($cmdline), "get-ciminstance") or
          re.regex($cmdline, `(?i)currentversion\\uninstall`) or
          strings.contains(strings.to_lower($cmdline), "installedprogramframework")
        )
      ) or
      // Linux/macOS package manager enumeration via shell
      (
        re.regex($proc_path, `(?i).*(bash|/sh|zsh)$`) and
        (
          strings.contains($cmdline, "dpkg -l") or
          strings.contains($cmdline, "dpkg --list") or
          re.regex($cmdline, `rpm -q[a]?\s`) or
          strings.contains($cmdline, "snap list") or
          strings.contains($cmdline, "brew list") or
          strings.contains($cmdline, "apt list") or
          strings.contains($cmdline, "yum list installed") or
          strings.contains($cmdline, "dnf list installed")
        )
      )
    )

    // Exclude legitimate system management parent processes running as SYSTEM
    not (
      re.regex($parent_path, `(?i).*(msiexec|trustedinstaller|svchost|ccmexec)\.exe$`) and
      re.regex($e.principal.user.userid, `(?i)(system|nt authority|local service)`)
    )

  match:
    $hostname over 5m

  outcome:
    $risk_score = max(
      if(
        re.regex($parent_path, `(?i).*(powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)\.exe$`) and
        (
          strings.contains(strings.to_lower($cmdline), "win32_product") or
          strings.contains(strings.to_lower($cmdline), "product get")
        ), 3
      ) +
      if(
        re.regex($parent_path, `(?i).*(powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)\.exe$`), 2
      ) +
      if(
        re.regex($proc_path, `(?i).*\\wmic\.exe$`), 1
      )
    )
    $discovery_count = count($e.target.process.pid)
    $target_process = array_distinct($proc_path)
    $parent_process = array_distinct($parent_path)

  condition:
    $e
}