Detect Unsecured Credentials in Google Chronicle

rule t1552_unsecured_credentials_access {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1552 Unsecured Credentials access via credential harvesting tool execution, sensitive file access, registry credential path queries, and scripted credential searches"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1552"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1552/"
    platform = "Windows"
    rule_version = "1.0"

  events:
    (
      // Branch 1: Known credential harvesting tools
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      (
        re.regex($e.principal.process.file.full_path, `(?i)(lazagne|netpass\.exe|passwordfox|webbrowserpassview|vaultpassview|credentialfileview|mailpassview|mimikatz|wce\.exe|pwdump|fgdump|gsecdump)`) or
        re.regex($e.target.process.command_line, `(?i)(lazagne|nirsoft|netpass|mimikatz)`)
      )
    ) or
    (
      // Branch 2: Credential file access (file create/read events)
      $e.metadata.event_type = "FILE_OPEN" and
      re.regex($e.target.file.full_path, `(?i)(\.pem$|\.pfx$|\.p12$|id_rsa|id_dsa|id_ecdsa|id_ed25519|unattend\.xml|sysprep\.xml|vnc\.ini|filezilla|winscp\.ini|putty|\.bash_history|\.aws[/\\]credentials|web\.config|password|passwd|credentials|creds|secret|apikey|api_key|\.ssh[/\\])`) and
      not re.regex($e.principal.process.file.full_path, `(?i)(svchost\.exe|SearchIndexer\.exe|MsMpEng\.exe|OneDrive\.exe)`)
    ) or
    (
      // Branch 3: Registry credential path queries
      $e.metadata.event_type = "REGISTRY_OPEN_KEY" and
      re.regex($e.target.registry.registry_key, `(?i)(WinVNC3[/\\]Password|TightVNC[/\\]Server|RealVNC[/\\]WinVNC4|SNMP[/\\]Parameters[/\\]ValidCommunities|Winlogon[/\\](Default|AltDefault)Password|PuTTY[/\\]Sessions|OpenSSH)`) and
      not re.regex($e.principal.process.file.full_path, `(?i)(svchost\.exe|lsass\.exe|services\.exe)`)
    ) or
    (
      // Branch 4: Scripted credential searches via shell/PowerShell
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.principal.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe|cmd\.exe|bash|\bsh\b)`) and
      re.regex($e.target.process.command_line, `(?i)(Get-Content|findstr|Select-String|grep|\btype\b|\bcat\b)`) and
      re.regex($e.target.process.command_line, `(?i)(password|passwd|credentials|secret|apikey|api_key|connectionstring|pwd|passw)`)
    )

  condition:
    $e
}