Detect Hybrid Identity in Google Chronicle

rule hybrid_identity_t1556_007 {
  meta:
    author = "Detection Engineering"
    description = "Detects T1556.007 Hybrid Identity - PTA agent registration, ADFS DLL/config tampering, anomalous AzureADConnect process spawning"
    mitre_attack_tactic = "Persistence, Defense Evasion, Credential Access"
    mitre_attack_technique = "T1556.007"
    severity = "HIGH"
    confidence = "HIGH"
    rule_version = "1.0"
    reference = "https://attack.mitre.org/techniques/T1556/007/"

  events:
    (
      $e.metadata.event_type = "FILE_MODIFICATION"
      and re.regex($e.target.file.full_path, `(?i)(\\ADFS\\|Microsoft\.IdentityServer|AzureADConnectAuthenticationAgentService)`)
      and re.regex($e.target.file.full_path, `(?i)\.(dll|config|exe)$`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e.target.process.file.full_path, `(?i)AzureADConnectAuthenticationAgentService\.exe`)
        or re.regex($e.principal.process.file.full_path, `(?i)AzureADConnectAuthenticationAgentService\.exe`)
      )
      and not re.regex($e.principal.process.file.full_path, `(?i)(services\.exe|svchost\.exe)`)
    )
    or
    (
      $e.metadata.event_type = "USER_RESOURCE_UPDATE_CONTENT"
      and re.regex($e.metadata.product_event_type, `(?i)(Add agent to application|Register connector|Pass-through authentication agent)`)
    )

  condition:
    $e
}