Detect Vulnerabilities in Google Chronicle

// T1588.006 — Vulnerability Research: Chronicle YARA-L 2.0 Detection Bundle
// Three rules covering exploit site access, exploit tool execution, and CVE file creation.
// Deploy all three rules to Chronicle for complete coverage.

rule t1588_006_exploit_site_access {
  meta:
    author = "Detection Engineering"
    description = "T1588.006 Branch 1 — Internal endpoint connecting to a known exploit repository or vulnerability database"
    mitre_attack_tactic = "Resource Development"
    mitre_attack_technique = "T1588.006"
    severity = "HIGH"
    confidence = "MEDIUM"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    re.regex($e.target.hostname,
      `(?i)(exploit\-db\.com|packetstormsecurity\.com|sploitus\.com|0day\.today|vulners\.com|cxsecurity\.com|seebug\.org|bugs\.chromium\.org)`
    )
    not re.regex($e.principal.process.file.full_path,
      `(?i)(\\svchost\.exe$|\\lsass\.exe$|\\services\.exe$)`
    )

  condition:
    $e
}

rule t1588_006_exploit_tool_execution {
  meta:
    author = "Detection Engineering"
    description = "T1588.006 Branch 2 — Exploit toolchain execution: searchsploit, Metasploit, nuclei with CVE templates, or CVE PoC scripts via interpreter"
    mitre_attack_tactic = "Resource Development"
    mitre_attack_technique = "T1588.006"
    severity = "HIGH"
    confidence = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.command_line, `(?i)searchsploit`)
      or re.regex($e.target.process.command_line, `(?i)msfconsole`)
      or re.regex($e.target.process.command_line, `(?i)msfvenom`)
      or (
        re.regex($e.target.process.command_line, `(?i)nuclei`) and
        re.regex($e.target.process.command_line, `(?i)(cve|\-t\s+cves)`)
      )
      or (
        re.regex($e.target.process.file.full_path, `(?i)(python(3)?\.exe$|ruby(\.exe)?$|perl(\.exe)?$)`) and
        re.regex($e.target.process.command_line,
          `(?i)(poc\.py|exploit\.py|exploit\.rb|exploit\.pl|CVE\-20[0-9]{2}\-[0-9]+|cve\-20[0-9]{2}\-[0-9]+)`
        )
      )
    )

  condition:
    $e
}

rule t1588_006_cve_file_creation {
  meta:
    author = "Detection Engineering"
    description = "T1588.006 Branch 3 — CVE-named, exploit-named, or 0day-named script or binary written to disk"
    mitre_attack_tactic = "Resource Development"
    mitre_attack_technique = "T1588.006"
    severity = "MEDIUM"
    confidence = "MEDIUM"
    priority = "MEDIUM"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    re.regex($e.target.file.full_path,
      `(?i)(CVE\-20[0-9]{2}\-[0-9]+|[/\\]poc\.|[/\\]exploit\.|0day\.)`
    )
    re.regex($e.target.file.full_path,
      `(?i)\.(py|rb|sh|ps1|pl|exe|c|cpp)$`
    )

  condition:
    $e
}