Detect Runtime Data Manipulation in Google Chronicle

rule t1565_003_runtime_data_manipulation {
  meta:
    author = "df00tech"
    description = "Detects T1565.003 Runtime Data Manipulation via process injection, suspicious DLL loads, or binary tampering targeting display/document applications"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1565.003"
    severity = "HIGH"
    priority = "HIGH"

  events:
    (
      // CreateRemoteThread or Process Access into display applications
      (
        $e.metadata.event_type = "PROCESS_INJECTION"
        and (
          $e.target.process.file.full_path = /(?i)(acrord32|acrobat|foxitreader|sumatrapdf|excel|winword|powerpnt|outlook|explorer|mmc|wmplayer)\.exe$/
        )
      )
      or
      // Suspicious process opening display application with write permissions
      (
        $e.metadata.event_type = "PROCESS_OPEN"
        and (
          $e.target.process.file.full_path = /(?i)(acrord32|acrobat|foxitreader|excel|winword|outlook)\.exe$/
        )
        and (
          $e.principal.process.file.full_path = /(?i)(powershell|pwsh|cmd|wscript|cscript|mshta|rundll32|regsvr32)\.exe$/
        )
      )
      or
      // Unexpected DLL load into document viewer (unsigned, non-standard path)
      (
        $e.metadata.event_type = "PROCESS_MODULE_LOAD"
        and (
          $e.principal.process.file.full_path = /(?i)(acrord32|acrobat|foxitreader|excel|winword)\.exe$/
        )
        and not (
          $e.target.file.full_path = /(?i)(C:\\Windows\\|C:\\Program Files\\Adobe\\|C:\\Program Files\\Foxit\\|C:\\Program Files\\Microsoft Office\\|C:\\Program Files \(x86\)\\Microsoft Office\\)/
        )
        and $e.target.file.pe_file.signature_info.signature_algorithm = ""
      )
      or
      // Binary tampering of display application executables
      (
        $e.metadata.event_type = "FILE_MODIFICATION"
        and (
          $e.target.file.full_path = /(?i)(Program Files\\Adobe|Program Files\\Foxit|Program Files\\Microsoft Office|Program Files \(x86\)\\Microsoft Office)/
        )
        and (
          $e.target.file.full_path = /(?i)\.(exe|dll)$/
        )
        and not (
          $e.principal.process.file.full_path = /(?i)(msiexec|setup|install|trustedinstaller|tiworker|svchost)\.exe$/
        )
      )
    )

  condition:
    $e
}