Detect Private Keys in Google Chronicle

rule T1552_004_private_key_access {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects access to or search for private key and certificate files (T1552.004). Covers SSH keys, TLS certs, PGP keys, and PKCS formats accessed by non-standard processes."
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1552.004"
    reference = "https://attack.mitre.org/techniques/T1552/004/"
    created = "2026-04-13"

  events:
    (
      $e.metadata.event_type = "FILE_OPEN"
      and (
        re.regex($e.target.file.full_path, `(?i)\.(pem|pfx|p12|ppk|pgp|gpg|asc|key|crt|cer|p7b)$`)
        or re.regex($e.target.file.full_path, `(?i)(id_rsa|id_ecdsa|id_ed25519|id_dsa)$`)
      )
      and not re.regex($e.principal.process.file.full_path,
        `(?i)(\bssh\b|\bscp\b|\bsftp\b|openssl|gpg|putty|certbot|nginx|apache|httpd|backup)`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e.target.process.command_line, `(?i)\.(pem|pfx|p12|ppk|pgp|gpg|asc|key|id_rsa|id_ecdsa|id_ed25519)`)
        and re.regex($e.target.process.command_line,
          `(?i)(\bfind\b|\blocate\b|Get-ChildItem|dir /s|findstr|mimikatz)`)
      )
    )

  condition:
    $e
}