Sensitive File Access - Unattended Panther

[rule]
description = """
Identifies an unusual process accessing Windows Panther Installation files. Adversaries may search local file systems
and remote file shares for files containing insecurely stored credentials.
"""
id = "52e4ad92-e09b-4331-b827-cd0f2cbaf576"
license = "Elastic License v2"
name = "Sensitive File Access - Unattended Panther"
os_list = ["windows"]
reference = [
    "https://steflan-security.com/windows-privilege-escalation-credential-harvesting/",
    "https://github.com/pha5matis/Pentesting-Guide/blob/master/privilege_escalation_windows.md",
]
version = "1.0.30"

query = '''
sequence by process.entity_id with maxspan=1m
   [process where event.action == "start" and
    user.id : ("S-1-5-21*", "S-1-12-*") and process.executable != null and
    process.hash.sha256 != "3e5bf6e2ac8ee4c7ccc60f51e5c4038ccf95b99f43f793b33b471681816a1d6b" and
    not process.executable :
          (
            /* third party programs common install path - requires local admin */
            "?:\\Program Files\\*",
            "?:\\Program Files (x86)\\*",

            /*
              dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
              explorer.exe for directory and file discovery.
              SearchProtocolHost.exe is for file searches and indexing.
             */
            "?:\\Windows\\explorer.exe",
            "?:\\Windows\\System32\\dllhost.exe",
            "?:\\Windows\\System32\\SearchProtocolHost.exe",

            /* Windows Defender */
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
            "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\*.exe",
            "?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",

            "?:\\Windows\\System32\\notepad.exe",
            "?:\\Windows\\System32\\Robocopy.exe",
            "?:\\Windows\\System32\\cmd.exe",
            "?:\\Windows\\System32\\xcopy.exe",
            "?:\\Windows\\System32\\SystemSettingsAdminFlows.exe",
            "?:\\Windows\\System32\\smartscreen.exe",
            "?:\\Windows\\System32\\Sysprep\\sysprep.exe",
            "?:\\WINDOWS\\OEM\\FieryLocaleSetup.exe",
            "?:\\Windows\\System32\\pnputil.exe",
            "?:\\Windows\\System32\\ResetEngine.exe")]
   [file where event.type == "access" and
    /* non system accounts */
    user.id : ("S-1-5-21*", "S-1-12-*") and
    file.path : ("?:\\Windows\\Panther\\Unattend.xml",
                 "?:\\Windows\\Panther\\Unattended.xml",
                 "?:\\Windows\\Panther\\Unattend\\Unattended.xml",
                 "?:\\Windows\\Panther\\Unattend\\Unattend.xml",
                 "?:\\Windows\\System32\\Sysprep\\unattend.xml",
                 "?:\\Windows\\System32\\Sysprep\\Panther\\unattend.xml")]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"