Purple Knight Tool Execution Detected

/*
 * Copyright 2025 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

rule hacktool_purpleknight_execution {

    meta:
      author = "Georg Lauenstein - suresecure GmbH"
      description = "This detection rule identifies the execution of the Purple Knight tool, a free Active Directory security assessment utility developed by Semperis. Purple Knight is designed to scan for AD vulnerabilities, misconfigurations, and common attack paths. While it is a legitimate tool used by defenders, its execution in production environments may also indicate red team activity or unauthorized reconnaissance by adversaries attempting to map domain weaknesses."
      rule_id = "mr_69e428bb-c946-4e3f-abb8-0e28316f2389"
      rule_name = "Purple Knight Tool Execution Detected"
      tactic = "TA0007"
      technique = "T1087"
      references = "https://www.purple-knight.com/"
      type = "alert"
      platform = "Windows, EDR"
      data_source = "Microsoft Sysmon, Windows Event Logs"
      severity = "Medium"  // Adjust based on your risk assessment
      priority = "Medium"  // Adjust based on your incident response process

    events:
      $purple_knight.metadata.event_type = "PROCESS_LAUNCH"
      (
        $purple_knight.target.process.file.full_path = /\\PurpleKnight\.exe$/ nocase or
        $purple_knight.principal.process.file.full_path = /\\PurpleKnight\.exe$/ nocase or
        $purple_knight.principal.process.command_line = /PurpleKnight/ nocase
      )

    // Capture the hostname where the event occurred
    $purple_knight.principal.hostname = $hostname

    match:
      $hostname over 10m

    outcome:
      $risk_score = max(65)
      $event_count = count_distinct($purple_knight.metadata.id)
      $principal_process_pid = array_distinct($purple_knight.principal.process.pid)
      $principal_process_command_line = array_distinct($purple_knight.principal.process.command_line)
      $principal_process_file_sha256 = array_distinct($purple_knight.principal.process.file.sha256)
      $principal_process_file_full_path = array_distinct($purple_knight.principal.process.file.full_path)
      $principal_process_product_specific_process_id = array_distinct($purple_knight.principal.process.product_specific_process_id)
      $principal_process_parent_process_product_specific_process_id = array_distinct($purple_knight.principal.process.parent_process.product_specific_process_id)
      $target_process_pid = array_distinct($purple_knight.target.process.pid)
      $target_process_command_line = array_distinct($purple_knight.target.process.command_line)
      $target_process_file_sha256 = array_distinct($purple_knight.target.process.file.sha256)
      $target_process_file_full_path = array_distinct($purple_knight.target.process.file.full_path)
      $target_process_product_specific_process_id = array_distinct($purple_knight.target.process.product_specific_process_id)
      $principal_user_userid = array_distinct($purple_knight.principal.user.userid)

    condition:
      $purple_knight
}