Team PCP-style Credential Harvesting
Details: Detects suspicious credential access activity when a single parent process on a host spawns multiple child processes whose command lines reference at least 3 unique credential-store categories within a 15-minute window. Aligns with Team PCP stealer behaviour analysed as part of the open source Shai-Hulud framework. Hypothesis: An adversary is harvesting credentials by rapidly enumerating multiple distinct credential stores through commands spawned from a common parent process. Actions: Due to how the query is structured and resource limitations in the collect() function, it is necessary to manually pivot from the detection summary into the host process telemetry and investigate the initiating process (ParentProcessID), the child processes (TargetProcessID) as well as the file names and command lines. The parent process is the most crucial aspect to consider when investigating this detection, and particular attention should be placed on unrecognised Python scripts which may indicate broader credential harvesting activity (see references). References: https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/#filesystem-scanning, https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/ **Any suggestions for improvements welcome**
CQL
