GAIA GCPW Credential Theft Attack Chain

Description

Detects the GAIA (Google Account Information and Authentication) credential theft attack chain: credential dumping tool execution on Windows followed by anomalous Google Workspace authentication. This pattern indicates an attacker has extracted OAuth refresh tokens from a Windows machine and is using them to authenticate to Google Workspace.

Query

Detection:
  - Group:
      - ID: Windows Credential Dump
        RuleID: Windows.Credential.Dumping.Tool
      - ID: Google Login Anomaly
        RuleID: Google.Workspace.Login.Type.Anomaly
    MatchCriteria:
      field_name:
        - GroupID: Windows Credential Dump
          Match: p_alert_context.username_normalized
        - GroupID: Google Login Anomaly
          Match: p_alert_context.username_normalized
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 10
    LookbackWindowMinutes: 1800

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

  • correlates · Panther group Google.Workspace.Login.Type.Anomaly within 1800m
    Not indexed on this site.
  • correlates · Panther group Windows.Credential.Dumping.Tool within 1800m

Analyst notes

  1. Query Windows.EventLogs for all process creation events (EventID 4688 or 1) on the Computer hostname from the Windows alert in the 24 hours before and after the credential dump timestamp to identify the parent process, command line arguments, and any follow-on suspicious activity
  2. Query GSuite.ActivityEvent for all login and OAuth token events by the user_email from the Google alert in the 48 hours after the Windows credential dump timestamp to establish the full timeline of authentication activity and identify the anomalous_login_type and source ip_address fields
  3. Verify that p_alert_context.username_normalized from the Windows Credential Dumping Tool alert matches p_alert_context.username_normalized from the Google Workspace Login Type Anomaly alert, and calculate the time gap between p_alert_creation_time values to assess if the attack timeline is consistent with GAIA credential theft exploitation (typically within 6 hours)
Raw source GAIA GCPW Credential Theft Attack Chain · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "GAIA.Credential.Theft.Attack.Chain.Group"
DisplayName: "GAIA GCPW Credential Theft Attack Chain"
Enabled: false
Severity: High
Description: |
  Detects the GAIA (Google Account Information and Authentication) credential theft
  attack chain: credential dumping tool execution on Windows followed by anomalous Google
  Workspace authentication. This pattern indicates an attacker has extracted OAuth refresh
  tokens from a Windows machine and is using them to authenticate to Google Workspace.
Reports:
  MITRE ATT&CK:
    - TA0006:T1003 # Credential Access: OS Credential Dumping
    - TA0006:T1003.001 # Credential Access: LSASS Memory
    - TA0001:T1078.004 # Initial Access: Valid Accounts: Cloud Accounts
    - TA0006:T1550 # Credential Access: Use Alternate Authentication Material
Tags:
  - GAIA
  - Google Workspace
  - Windows
  - Credential Theft
  - Credential Dumping
  - GCPW
Reference: https://businessinsights.bitdefender.com/the-chain-reaction-new-methods-for-extending-local-breaches-in-google-workspace
Runbook: |
  1. Query Windows.EventLogs for all process creation events (EventID 4688 or 1) on the Computer hostname from the Windows alert in the 24 hours before and after the credential dump timestamp to identify the parent process, command line arguments, and any follow-on suspicious activity
  2. Query GSuite.ActivityEvent for all login and OAuth token events by the user_email from the Google alert in the 48 hours after the Windows credential dump timestamp to establish the full timeline of authentication activity and identify the anomalous_login_type and source ip_address fields
  3. Verify that p_alert_context.username_normalized from the Windows Credential Dumping Tool alert matches p_alert_context.username_normalized from the Google Workspace Login Type Anomaly alert, and calculate the time gap between p_alert_creation_time values to assess if the attack timeline is consistent with GAIA credential theft exploitation (typically within 6 hours)
Detection:
  - Group:
      - ID: Windows Credential Dump
        RuleID: Windows.Credential.Dumping.Tool
      - ID: Google Login Anomaly
        RuleID: Google.Workspace.Login.Type.Anomaly
    MatchCriteria:
      field_name:
        - GroupID: Windows Credential Dump
          Match: p_alert_context.username_normalized
        - GroupID: Google Login Anomaly
          Match: p_alert_context.username_normalized
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 10
    LookbackWindowMinutes: 1800
Tests:
  - Name: Credential dump followed by login anomaly for same user
    ExpectedResult: true
    RuleOutputs:
      - ID: Windows Credential Dump
        Matches:
          p_alert_context.username_normalized:
            janedoe:
              - "2024-01-15T10:00:00Z"
      - ID: Google Login Anomaly
        Matches:
          p_alert_context.username_normalized:
            janedoe:
              - "2024-01-15T10:30:00Z"
  - Name: Credential dump and login anomaly for different users
    ExpectedResult: false
    RuleOutputs:
      - ID: Windows Credential Dump
        Matches:
          p_alert_context.username_normalized:
            janedoe:
              - "2024-01-15T10:00:00Z"
      - ID: Google Login Anomaly
        Matches:
          p_alert_context.username_normalized:
            johnsmith:
              - "2024-01-15T14:30:00Z"
  - Name: Login anomaly without preceding credential dump
    ExpectedResult: false
    RuleOutputs:
      - ID: Google Login Anomaly
        Matches:
          p_alert_context.username_normalized:
            janedoe:
              - "2024-01-15T14:30:00Z"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.