Detect Password Managers in Google Chronicle

rule T1555_005_Password_Manager_Credential_Theft {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects password manager credential theft via known attack tools, unauthorized database file access, or memory dumping of password manager processes"
    reference = "https://attack.mitre.org/techniques/T1555/005/"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1555.005"
    severity = "HIGH"
    confidence = "HIGH"
    created = "2026-04-13"

  events:
    (
      (
        $e.metadata.event_type = "PROCESS_LAUNCH" and
        (
          re.regex($e.target.process.command_line, `(?i)(keethief|keepass2john|kpcli|Find-KeePassConfig|Get-KeePassDatabaseKey|KeePassHax)`) or
          re.regex($e.target.process.file.full_path, `(?i)(\\keethief|\\keepass2john)`) or
          re.regex($e.target.process.command_line, `(?i)(procdump.{0,40}keepass|minidump.{0,40}keepass|comsvcs.{0,40}keepass)`)
        )
      ) or
      (
        $e.metadata.event_type = "FILE_READ" and
        re.regex($e.target.file.full_path, `(?i)(\.(kdbx|kdb|psafe3|agilekeychain|1pif)$|1Password\.sqlite|KeePass\.config\.xml|LastPass\.sqlite)`) and
        not re.regex($e.principal.process.file.full_path, `(?i)(KeePass\.exe|1Password\.exe|LastPass\.exe|Bitwarden\.exe|Dashlane\.exe|RoboForm\.exe)`)
      )
    )

  condition:
    $e
}