Detect Steal Application Access Token in Elastic Security

any where
  (
    // Vector 1: Cloud IMDS token requests from non-native processes
    event.category == "network" and
    destination.ip == "169.254.169.254" and
    (
      url.full like~ "*metadata/identity*" or
      url.full like~ "*iam/security-credentials*" or
      url.full like~ "*computeMetadata/v1/instance/service-accounts*" or
      url.full like~ "*metadata/instance*"
    ) and
    not process.name in~ (
      "waagent.exe", "WindowsAzureGuestAgent.exe", "WaAppAgent.exe",
      "MonAgentCore.exe", "HealthService.exe", "MMAExtensionHeartbeatService.exe",
      "AzureAttestService.exe", "azd.exe", "AzureCLI.exe"
    )
  ) or
  (
    // Vector 2: Kubernetes service account token file reads by unexpected processes
    event.category == "file" and
    (
      file.path like~ "*/var/run/secrets/kubernetes.io/serviceaccount/*" or
      file.path like~ "*/run/secrets/kubernetes.io/*" or
      file.path like~ "*/var/run/secrets/tokens/*"
    ) and
    file.name in~ ("token", "ca.crt") and
    not process.name in~ (
      "kubelet", "pause", "containerd-shim", "containerd-shim-runc-v2",
      "runc", "cri-o", "dockerd"
    )
  ) or
  (
    // Vector 3: OAuth and cloud CLI token cache access by unexpected processes
    event.category == "file" and
    (
      file.name in~ (
        "application_default_credentials.json", "accessTokens.json",
        "azureProfile.json", "msal_token_cache.json", "msal_token_cache.bin",
        "TokenCache.dat", ".git-credentials"
      ) or
      (file.path like~ "*/.config/gcloud/*" and file.extension == "json") or
      (file.path like~ "*/.azure/*" and file.extension == "json") or
      file.path like~ "*/TokenCache/*"
    ) and
    not process.name in~ (
      "gcloud", "gcloud.exe", "aws", "aws.exe", "az", "az.exe",
      "gh", "gh.exe", "git", "git.exe", "Code.exe", "code",
      "terraform", "terraform.exe", "kubectl", "kubectl.exe"
    )
  )