Detect Silver Ticket in Google Chronicle

rule t1558_002_silver_ticket {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Silver Ticket attacks via Mimikatz/Rubeus/PowerShell tool execution (PROCESS_LAUNCH) and Kerberos RC4 downgrade (Event 4769). Covers AADInternals Azure AD SSO silver ticket variant."
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1558.002"
    severity = "CRITICAL"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1558/002/"

  events:
    (
      /* Method 1a: Mimikatz or Rubeus direct binary execution */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and (
          re.regex($e.target.process.file.full_path, `(?i)(mimikatz(64)?\.exe$|rubeus\.exe$)`)
          or re.regex($e.principal.process.file.full_path, `(?i)(mimikatz(64)?\.exe$|rubeus\.exe$)`)
        )
        and re.regex($e.target.process.command_line, `(?i)(kerberos::silver|kerberos::ptt|\/ptt|sekurlsa::tickets|s4u|asktgs|createnetonly)`)
      )
      or
      /* Method 1b: PowerShell Invoke-Mimikatz / Rubeus loader / AADInternals */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`)
        and re.regex($e.target.process.command_line, `(?i)(invoke-mimikatz|invoke-kerberoast|rubeus|new-aadintkerberosticket)`)
        and re.regex($e.target.process.command_line, `(?i)(silver|kerberos::ptt|\/ptt|\/target:|\/rc4:|azureadssoacc|seamlesssso)`)
      )
      or
      /* Method 2: Kerberos RC4 downgrade — Windows Security Event 4769 */
      /* TicketEncryptionType is mapped to extensions.auth.auth_details by the Chronicle */
      /* Windows Security Event Log parser; verify field mapping in your environment. */
      (
        $e.metadata.product_event_type = "4769"
        and (
          $e.extensions.auth.auth_details = "0x17"
          or $e.extensions.auth.auth_details = "0x18"
        )
        and not re.regex($e.target.resource.name, `.*\$$`)
        and $e.target.resource.name != "krbtgt"
        and $e.target.resource.name != "UNKNOWN"
        and $e.target.resource.name != "-"
        and not re.regex($e.principal.user.userid, `.*\$$`)
        and $e.principal.user.userid != "-"
      )
    )

  condition:
    $e
}