Detect Steal Application Access Token in CrowdStrike LogScale

// T1528 - Steal Application Access Token
// Detect IMDS token requests, Kubernetes token access, and OAuth token cache reads
// via CrowdStrike Falcon telemetry in LogScale

#event_simpleName in ("NetworkConnectIP4", "FileOpenInfo", "SuspiciousFileOpenInfo")
| case {
    // Vector 1: IMDS token requests from non-native processes
    #event_simpleName = "NetworkConnectIP4"
    AND RemoteAddressIP4 = "169.254.169.254"
    | where not ImageFileName = /waagent\.exe|WindowsAzureGuestAgent\.exe|WaAppAgent\.exe|MonAgentCore\.exe|HealthService\.exe|MMAExtensionHeartbeatService\.exe|AzureAttestService\.exe|azd\.exe|AzureCLI\.exe/i
    | vector := "IMDS Token Request"
    | tokenPlatform := "Cloud IMDS"
    | suspicionScore := 3;

    // Vector 2: Kubernetes service account token file reads by unexpected processes
    #event_simpleName in ("FileOpenInfo", "SuspiciousFileOpenInfo")
    AND TargetFileName = /\/var\/run\/secrets\/kubernetes\.io\/serviceaccount|\/run\/secrets\/kubernetes\.io|\/var\/run\/secrets\/tokens/
    | where not ImageFileName = /kubelet|pause|containerd-shim|containerd-shim-runc-v2|runc|cri-o|dockerd/i
    | vector := "Kubernetes Service Account Token"
    | tokenPlatform := "Kubernetes"
    | suspicionScore := 3;

    // Vector 3: OAuth and cloud CLI token cache file access by unexpected processes
    #event_simpleName in ("FileOpenInfo", "SuspiciousFileOpenInfo")
    AND TargetFileName = /msal_token_cache\.(json|bin)|accessTokens\.json|application_default_credentials\.json|azureProfile\.json|\.git-credentials|TokenCache\.dat|\.config\/gcloud\/.+\.json|\.azure\/.+\.json/i
    | where not ImageFileName = /gcloud(\.exe)?$|aws(\.exe)?$|az(\.exe)?$|gh(\.exe)?$|git(\.exe)?$|terraform(\.exe)?$|kubectl(\.exe)?$|Code\.exe$|^code$/i
    | vector := "OAuth Token Cache Access"
    | tokenPlatform := case(
        TargetFileName = /msal|\.azure/i, "Azure",
        TargetFileName = /application_default|\.config\/gcloud/i, "GCP",
        TargetFileName = /\.git-credentials/, "GitHub/Git",
        "Multi-Cloud"
      )
    | suspicionScore := 2;

    * | drop()
  }
| groupBy(
    [ComputerName, UserName, ImageFileName, TargetFileName, RemoteAddressIP4, vector, tokenPlatform],
    function=[
      count(as=eventCount),
      max(@timestamp, as=lastSeen),
      min(@timestamp, as=firstSeen),
      collect(CommandLine, limit=5, as=observedCommandLines)
    ]
  )
| suspicionScore := case(
    vector = "IMDS Token Request", 3,
    vector = "Kubernetes Service Account Token", 3,
    vector = "OAuth Token Cache Access", 2,
    1
  )
| riskLabel := case(
    suspicionScore >= 3, "HIGH",
    suspicionScore = 2, "MEDIUM",
    "LOW"
  )
| sort(lastSeen, order=desc)