Detect Archive via Custom Method in Google Chronicle

// Rule 1: Scripting engines executing inline XOR or custom cipher operations
rule T1560_003_CustomCrypto_ScriptEngine {
  meta:
    author = "Detection Engineer"
    description = "T1560.003 - Detects scripting hosts (PowerShell, Python, WScript, CScript, CMD) whose command line contains XOR operator keywords, bitwise cipher identifiers, or named custom cipher strings associated with FIN6, StrongPity, CopyKittens, and related threat actors."
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1560.003"
    mitre_attack_subtechnique = "T1560.003"
    severity = "HIGH"
    confidence = "MEDIUM"
    reference = "https://attack.mitre.org/techniques/T1560/003/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path = /(?i)(powershell|pwsh|python3?|wscript|cscript|cmd)\.exe$/
    (
      $e.target.process.command_line = /(?i)(-bxor|bitxor|xorkey|xor_key|xorbytes|xorencrypt|0x[Aa][Aa]|0x23|bxor\s+0x|bytexor|xorfile)/ or
      $e.target.process.command_line = /(?i)(blowfish|\brc4\b|arcfour|stream\s+cipher|substitution|rot13|rotl\(|rotr\(|custom\s+encrypt|xor\s+cipher|xor\s+encrypt)/
    )

  condition:
    $e
}

// Rule 2: Bulk creation of files with custom encrypted extensions by non-archiver processes
rule T1560_003_BulkEncryptedFileCreation {
  meta:
    author = "Detection Engineer"
    description = "T1560.003 - Detects bulk creation of files bearing custom encrypted output extensions (.sft, .enc, .crypt, .xor, .locked, .rms) by processes that are not known archive utilities, consistent with StrongPity .sft staging, BLUELIGHT XOR blob output, and similar custom-archive malware behavior."
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1560.003"
    mitre_attack_subtechnique = "T1560.003"
    severity = "HIGH"
    confidence = "MEDIUM"
    reference = "https://attack.mitre.org/techniques/T1560/003/"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    $e.target.file.full_path = /(?i)\.(sft|enc|crypt|xor|locked|rms)$/
    not $e.principal.process.file.full_path = /(?i)(7z|winrar|winzip|pkzip|zip|tar|gzip|bzip2)\.exe$/
    not $e.target.file.full_path = /(?i)(\\Windows\\|\\Program Files\\)/

  match:
    $e.principal.hostname over 5m

  outcome:
    $file_count = count_distinct($e.target.file.full_path)
    $sample_files = array_distinct($e.target.file.full_path)
    $creating_process = array_distinct($e.principal.process.file.full_path)

  condition:
    #e >= 5
}