Sensitive File Access - SSH Saved Keys

[rule]
description = """
Identifies an unusual process accessing common SSH clients saved SSH keys. Adversaries may search local file systems and
remote file shares for files containing insecurely stored credentials.
"""
id = "1487d726-2bd2-4a9e-a9d2-db8aef1d6239"
license = "Elastic License v2"
name = "Sensitive File Access - SSH Saved Keys"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
version = "1.0.39"

query = '''
any where event.category in ("registry", "file") and
 event.action in ("query", "open") and
 user.id like ("S-1-5-21*", "S-1-12-*") and process.executable : "C:\\*" and
 (file.path : "?:\\Users\\*\\.ssh\\known_hosts" or
  registry.path :
        ("HKEY_USERS\\S-1-5-21*\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\*",
         "HKEY_USERS\\S-1-12-1-*\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\*")) and
  not process.executable :
      ("?:\\Program Files\\*",
	   "?:\\Program Files (x86)\\*", 
	   "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", 
	   "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe",
	   "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe",
	   "?:\\Windows\\System32\\OpenSSH\\*.exe", 
	   "?:\\Windows\\System32\\smartscreen.exe", 
	   "?:\\WINDOWS\\system32\\reg.exe", 
	   "?:\\Windows\\regedit.exe", 
	   "?:\\Windows\\System32\\notepad.exe", 
	   "?:\\Windows\\System32\\Robocopy.exe",
	   "?:\\Windows\\System32\\cmd.exe",
	   "?:\\Windows\\explorer.exe",
       "?:\\Windows\\System32\\mmc.exe",
	   "?:\\Windows\\System32\\svchost.exe",
	   "?:\\$WINDOWS.~BT\\Sources\\setuphost.exe",
	   "?:\\Users\\*\\AppData\\Local\\Programs\\Git\\mingw64\\bin\\git.exe",
	   "?:\\Users\\*\\AppData\\Local\\DBeaver\\dbeaver.exe",
	   "?:\\Users\\*\\Tools\\dbeaver\\dbeaver.exe",
	   "?:\\Windows\\System32\\SearchProtocolHost.exe",
	   "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
	   "?:\\ProgramData\\GalacticScan\\GalacticScan.exe",
	   "?:\\Users\\*\\AppData\\Local\\Programs\\GalacticScan\\GalacticScan_Warpspeed.exe",
	   "?:\\Users\\*\\AppData\\Local\\Postman\\app-*\\Postman.exe",
	   "?:\\Users\\*\\OneDrive\\*\\Wintriage\\Tools\\ADSecurizame.exe",
	   "?:\\Users\\*\\AppData\\Local\\JetBrains\\Toolbox\\apps\\Gateway\\*\\bin\\gateway64.exe",
	   "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
	   "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\*\\@vscode\\ripgrep\\bin\\rg.exe",
	   "?:\\programs\\!_local\\SmartGit\\bin\\smartgit.exe",
	   "?:\\Windows\\System32\\dllhost.exe",
	   "?:\\Windows\\System32\\OpenWith.exe",
	   "?:\\Windows\\System32\\userinit.exe",
	   "?:\\Windows\\System32\\fhmanagew.exe",
	   "C:\\OSGeo4W64\\bin\\qgis-ltr-bin.exe",
	   "C:\\Users\\*\\Anaconda3\\pythonw.exe") and

  /* many of the following exclusions are not signed nor have an original file name  */
  not process.name : ("pscp.exe", "psftp.exe", "_ssh.exe", "plink.exe", "PuTTYNG.exe", "putty*.exe", "busybox.exe",
                      "ssh.exe", "WinSCP.exe", "bash.exe", "MoTTY.exe", "eclipse.exe", "code.exe", "datagrip*.exe",
                      "MobaXterm_Personal*.exe", "RoyalTS_PuTTY*.exe", "MAP.EXE", "rssputty.exe", "phpstorm64.exe",
                      "Fork.exe", "fzsftp.exe", "OneDrive.exe") and
  not (process.code_signature.subject_name :
               ("Galactic Advisors, Inc.", "Simon Tatham", "Atlassian Pty Ltd", "Emsisoft Limited", "JetBrains s.r.o.",
                "ESET, spol. s r.o.", "Notepad++", "Open Source Developer, Sven Strickroth", "ShowMyPC", "AXOSOFT, LLC",
                "General Services Administration", "ShowMyPC INC", "Oracle America, Inc.", "CS.DISA-RE11.08-0031", "Mobatek", 
		"DBeaver Corp", "Eclipse.org Foundation, Inc.", "Shadow", "The Qt Company Oy", "Anysphere, Inc.",
		"International Business Machines Corporation", "Red Hat, Inc", "SmartBear Software Inc.",
		"Python Software Foundation", "Amazon.com Services LLC", "OpenJS Foundation", "T3 Tools Inc",
		"KICAD SERVICES CORPORATION", "VNG GROUP JSC", "The FreeCAD project association AISBL") and
       process.code_signature.status in ("trusted", "errorChaining")) and
  process.thread.Ext.call_stack_summary != "ntdll.dll|cygwin1.dll"
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.004"
name = "SSH"
reference = "https://attack.mitre.org/techniques/T1021/004/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "8.7.0"