Update credential_access_multi_could_secrets_via_api.toml

Author: Samirbous

rules/cross-platform/credential_access_multi_could_secrets_via_api.toml

@@ -125,7 +125,7 @@ FROM logs-azure.platformlogs-*, logs-azure.activitylogs-*, logs-aws.cloudtrail-*
 
     // Azure Managed HSM secret
     event.dataset == "azure.activitylogs" AND
-    event.action LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/%", true,
+    event.action LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/*", true,
 
     // Google Secret Manager
     event.dataset IN ("googlecloud.audit", "gcp.audit") AND
@@ -150,64 +150,53 @@ FROM logs-azure.platformlogs-*, logs-azure.activitylogs-*, logs-aws.cloudtrail-*
 
 // Cloud vendor label based on dataset
 | EVAL Esql.cloud_vendor = CASE(
-    event.dataset == "aws.cloudtrail",                         "aws",
+    event.dataset == "aws.cloudtrail", "aws",
     event.dataset IN ("azure.platformlogs","azure.activitylogs"), "azure",
-    event.dataset IN ("googlecloud.audit","gcp.audit"),        "gcp",
+    event.dataset IN ("googlecloud.audit","gcp.audit"), "gcp",
     "unknown"
   )
 
 // Vendor+tenant label, e.g. aws:123456789012, azure:tenant, gcp:project
 | EVAL Esql.tenant_label = CASE(
-    Esql.cloud_vendor == "aws",   CONCAT("aws:",   cloud.account.id),
+    Esql.cloud_vendor == "aws", CONCAT("aws:", cloud.account.id),
     Esql.cloud_vendor == "azure", CONCAT("azure:", cloud.account.id),
-    Esql.cloud_vendor == "gcp",   CONCAT("gcp:",   cloud.account.id),
+    Esql.cloud_vendor == "gcp", CONCAT("gcp:", cloud.account.id),
     NULL
   )
 
 | STATS
     // Core counts
-    Esql.events_count       = COUNT(*),
-    Esql.dataset_count_distinct      = COUNT_DISTINCT(event.dataset),
+    Esql.events_count = COUNT(*),
+    Esql.dataset_count_distinct = COUNT_DISTINCT(event.dataset),
 
     // Action & data source context
-    Esql.event_action_values   = VALUES(event.action),
-    Esql.data_source_values    = VALUES(event.dataset),
+    Esql.event_action_values = VALUES(event.action),
+    Esql.data_source_values = VALUES(event.dataset),
 
     // Cloud vendor + tenant context
-    Esql.cloud_vendor_values   = VALUES(Esql.cloud_vendor),
-    Esql.tenant_label_values   = VALUES(Esql.tenant_label),
+    Esql.cloud_vendor_values = VALUES(Esql.cloud_vendor),
+    Esql.tenant_label_values = VALUES(Esql.tenant_label),
 
     // Hyperscaler-specific IDs
-    Esql.aws_account_id_values   =
-      VALUES(CASE(Esql.cloud_vendor == "aws",   cloud.account.id, NULL)),
-    Esql.azure_tenant_id_values  =
-      VALUES(CASE(Esql.cloud_vendor == "azure", cloud.account.id, NULL)),
-    Esql.gcp_project_id_values   =
-      VALUES(CASE(Esql.cloud_vendor == "gcp",   cloud.account.id, NULL)),
+    Esql.aws_account_id_values = VALUES(CASE(Esql.cloud_vendor == "aws", cloud.account.id, NULL)),
+    Esql.azure_tenant_id_values = VALUES(CASE(Esql.cloud_vendor == "azure", cloud.account.id, NULL)),
+    Esql.gcp_project_id_values = VALUES(CASE(Esql.cloud_vendor == "gcp", cloud.account.id, NULL)),
 
     // Generic cloud metadata
-    Esql.cloud_region_values     = VALUES(cloud.region),
-    Esql.cloud_service_name_values =
-      VALUES(cloud.service.name),
-
-    // Network context
-    Esql.source_ip_values = VALUES(source.ip),
+    Esql.cloud_region_values = VALUES(cloud.region),
+    Esql.cloud_service_name_values = VALUES(cloud.service.name),
 
     // Identity (privileged)
-    Esql_priv.user_values =
-      VALUES(Esql_priv.user_id),
-    Esql_priv.client_user_id_values =
-      VALUES(client.user.id),
-    Esql_priv.aws_user_identity_arn_values =
-      VALUES(aws.cloudtrail.user_identity.arn),
-    Esql_priv.azure_upn_values =
-      VALUES(azure.platformlogs.identity.claim.upn)
+    Esql_priv.user_values = VALUES(Esql_priv.user_id),
+    Esql_priv.client_user_id_values = VALUES(client.user.id),
+    Esql_priv.aws_user_identity_arn_values = VALUES(aws.cloudtrail.user_identity.arn),
+    Esql_priv.azure_upn_values = VALUES(azure.platformlogs.identity.claim.upn)
   BY source.ip
 
-// Require multi-dataset (cross-source) behavior from same source IP
+// Require multi-dataset behavior from same source IP
 | WHERE Esql.dataset_count_distinct >= 2
 | SORT Esql.events_count DESC
-| KEEP Esql.*, Esql_priv.*
+| KEEP Esql.*, Esql_priv.*, source.ip
 '''
 
 
@@ -228,4 +217,4 @@ reference = "https://attack.mitre.org/techniques/T1555/006/"
 [rule.threat.tactic]
 id = "TA0006"
 name = "Credential Access"
-reference = "https://attack.mitre.org/tactics/TA0006/"
+reference = "https://attack.mitre.org/tactics/TA0006/"