Detect Steal Application Access Token in Google Chronicle

rule t1528_steal_application_access_token {
  meta:
    author = "Argus Detection Platform"
    description = "Detects T1528 - Steal Application Access Token via IMDS queries, Kubernetes token reads, and OAuth token cache access"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1528"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1528/"
    false_positives = "Cloud VM agents, Kubernetes orchestration processes, cloud CLI toolchains"
    version = "1.0"

  events:
    (
      $e.metadata.event_type = "NETWORK_CONNECTION" or
      $e.metadata.event_type = "FILE_OPEN" or
      $e.metadata.event_type = "FILE_READ"
    )
    (
      // Vector 1: Cloud IMDS token requests from non-native processes
      (
        $e.metadata.event_type = "NETWORK_CONNECTION" and
        $e.target.ip = "169.254.169.254" and
        (
          re.regex($e.network.http.request_url, `metadata/identity`) or
          re.regex($e.network.http.request_url, `iam/security-credentials`) or
          re.regex($e.network.http.request_url, `computeMetadata/v1/instance/service-accounts`) or
          re.regex($e.network.http.request_url, `metadata/instance`)
        ) and
        not re.regex($e.principal.process.file.full_path, `(?i)(waagent\.exe|WindowsAzureGuestAgent\.exe|WaAppAgent\.exe|MonAgentCore\.exe|HealthService\.exe|MMAExtensionHeartbeatService\.exe|AzureAttestService\.exe|azd\.exe|AzureCLI\.exe)`)
      ) or
      // Vector 2: Kubernetes service account token reads by unexpected processes
      (
        ($e.metadata.event_type = "FILE_OPEN" or $e.metadata.event_type = "FILE_READ") and
        (
          re.regex($e.target.file.full_path, `/var/run/secrets/kubernetes\.io/serviceaccount`) or
          re.regex($e.target.file.full_path, `/run/secrets/kubernetes\.io`) or
          re.regex($e.target.file.full_path, `/var/run/secrets/tokens`)
        ) and
        not re.regex($e.principal.process.file.full_path, `(?i)(kubelet|pause|containerd-shim|containerd-shim-runc-v2|runc|cri-o|dockerd)`)
      ) or
      // Vector 3: OAuth and cloud CLI token cache file access by unexpected processes
      (
        ($e.metadata.event_type = "FILE_OPEN" or $e.metadata.event_type = "FILE_READ") and
        (
          re.regex($e.target.file.full_path, `(?i)(msal_token_cache\.(json|bin)|accessTokens\.json|application_default_credentials\.json|azureProfile\.json|\.git-credentials|TokenCache\.dat)`) or
          re.regex($e.target.file.full_path, `\.config/gcloud/.+\.json`) or
          re.regex($e.target.file.full_path, `/\.azure/.+\.json`)
        ) and
        not re.regex($e.principal.process.file.full_path, `(?i)(gcloud(\.exe)?$|aws(\.exe)?$|az(\.exe)?$|gh(\.exe)?$|git(\.exe)?$|terraform(\.exe)?$|kubectl(\.exe)?$|Code\.exe$|^code$)`)
      )
    )

  condition:
    $e
}