admin/Karma-X-Inc-protections-artifacts
1
0
Fork 0
mirror of https://github.com/Karma-X-Inc/protections-artifacts synced 2026-06-08 11:28:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updating artifacts

Browse Source
This commit is contained in:
protectionsmachine
2023-07-13 22:16:13 +00:00
parent b15eed26c9
commit ec4731c2bf
498 changed files with 2203 additions and 625 deletions
Download Patch File Download Diff File Expand all files Collapse all files
behavior/rules/collection_suspicious_directshow_devices_enumeration.toml
+66
View File
@@ -0,0 +1,66 @@
[rule]
description = """
Identifies attempt to enumerate accessible DirectShow devices by an unusual process to potentially capture audio or
video using the Microsoft DirectShow application programming interface.
"""
id = "d6699c83-fb2f-4029-8fb4-0f628f131a22"
license = "Elastic License v2"
name = "Suspicious DirectShow Devices Enumeration"
os_list = ["windows"]
reference = ["https://learn.microsoft.com/en-us/windows/win32/directshow/directshow"]
version = "1.0.3"
query = '''
registry where registry.path : "HKEY_USERS\\*\\Software\\Microsoft\\ActiveMovie\\devenum*\\Version" and
(
process.thread.Ext.call_stack_summary : ("*|devenum.dll|combase.dll|Unbacked*", "*devenum.dll|clr.dll|mscorlib.ni.dll|Unbacked*") or
process.name : ("rundll32.exe", "regsvr32.exe") or
process.executable : "?:\\Windows\\Microsoft.NET\\*" or
(process.executable : "?:\\Users\\*" and not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*"))
)
and not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe", "?:\\Windows\\Sys*\\DriverStore\\FileRepository\\*.exe")
'''
min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1123"
name = "Audio Capture"
reference = "https://attack.mitre.org/techniques/T1123/"
[[threat.technique]]
id = "T1125"
name = "Video Capture"
reference = "https://attack.mitre.org/techniques/T1125/"
[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
[internal]
min_endpoint_version = "8.7.0"
behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "fb6939a2-1b54-428c-92a2-3a831585af2a"
license = "Elastic License v2"
name = "Connection to Dynamic DNS Provider by a Signed Binary Proxy"
os_list = ["windows"]
version = "1.0.22"
version = "1.0.23"
query = '''
sequence by process.entity_id with maxspan=5m
behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "75b80e66-90d0-4ab6-9e6b-976f7d690906"
license = "Elastic License v2"
name = "Connection to Dynamic DNS Provider by an Unsigned Binary"
os_list = ["windows"]
version = "1.0.23"
version = "1.0.24"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "c567240c-445b-4000-9612-b5531e21e050"
license = "Elastic License v2"
name = "Connection to WebService by a Signed Binary Proxy"
os_list = ["windows"]
version = "1.0.29"
version = "1.0.30"
query = '''
sequence by process.entity_id with maxspan=5m
behavior/rules/command_and_control_connection_to_webservice_by_an_unsigned_binary.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "2c3efa34-fecd-4b3b-bdb6-30d547f2a1a4"
license = "Elastic License v2"
name = "Connection to WebService by an Unsigned Binary"
os_list = ["windows"]
version = "1.0.28"
version = "1.0.29"
query = '''
sequence by process.entity_id with maxspan=5m
behavior/rules/command_and_control_curl_execution_via_apple_installer_package.toml
+41
View File
@@ -0,0 +1,41 @@
[rule]
description = """
Detects when curl is executed with the -o option and the effective parent process is an Apple installer process. Threat
actors will utilize benign or backdoored software packages to download second stage payloads using curl in order to
avoid detection and gain malicious code execution. An example of this activity is the nation state malware known as
oRAT.
"""
id = "a4a66e7f-b81a-4a2c-8f33-28a6807314a9"
license = "Elastic License v2"
name = "Curl Execution via Apple Installer Package"
os_list = ["macos"]
version = "1.0.2"
query = '''
process where event.type == "start" and
process.name : "curl" and process.args : ("-o", "--output") and
process.Ext.effective_parent.name : ("installer", "package_script_service")
'''
min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.5.0"
behavior/rules/command_and_control_curl_from_volume_mount.toml
+1 -1
View File
@@ -10,7 +10,7 @@ license = "Elastic License v2"
name = "Curl from Volume Mount"
os_list = ["macos"]
reference = ["https://objective-see.org/blog/blog_0x71.html"]
version = "1.0.11"
version = "1.0.12"
query = '''
process where event.type == "start" and event.action == "exec" and process.name : "curl" and
behavior/rules/command_and_control_dns_query_to_suspicious_top_level_domain.toml
+1 -1
View File
@@ -8,7 +8,7 @@ id = "d37ffe39-8e58-460f-938d-3bafbae60711"
license = "Elastic License v2"
name = "DNS Query to Suspicious Top Level Domain"
os_list = ["windows"]
version = "1.0.8"
version = "1.0.9"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/command_and_control_execution_of_a_file_written_by_a_signed_binary_proxy.toml
+1 -1
View File
@@ -8,7 +8,7 @@ id = "ccbc4a79-3bae-4623-aaef-e28a96bf538b"
license = "Elastic License v2"
name = "Execution of a File Written by a Signed Binary Proxy"
os_list = ["windows"]
version = "1.0.23"
version = "1.0.24"
query = '''
sequence with maxspan=5m
behavior/rules/command_and_control_ingress_tool_transfer_via_curl.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "336ada1c-69f8-46e8-bdd2-790c85429696"
license = "Elastic License v2"
name = "Ingress Tool Transfer via CURL"
os_list = ["windows"]
version = "1.0.18"
version = "1.0.19"
query = '''
process where event.action == "start" and
behavior/rules/command_and_control_ingress_tool_transfer_via_powershell.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "5abd98fb-ffbe-4cd6-9592-3cda7b155ff5"
license = "Elastic License v2"
name = "Ingress Tool Transfer via PowerShell"
os_list = ["windows"]
version = "1.0.10"
version = "1.0.11"
query = '''
process where event.action == "start" and not user.id : "S-1-5-18" and
behavior/rules/command_and_control_library_load_of_a_file_written_by_a_signed_binary_proxy.toml
+1 -1
View File
@@ -8,7 +8,7 @@ id = "7b5a1c52-12ff-4c1b-b1f1-2226ceb11c9a"
license = "Elastic License v2"
name = "Library Load of a File Written by a Signed Binary Proxy"
os_list = ["windows"]
version = "1.0.17"
version = "1.0.18"
query = '''
sequence with maxspan=5m
behavior/rules/command_and_control_netwire_rat_registry_modification.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "NetWire RAT Registry Modification"
os_list = ["windows"]
reference = ["https://attack.mitre.org/software/S0198/", "https://any.run/malware-trends/netwire"]
version = "1.0.22"
version = "1.0.23"
query = '''
registry where
behavior/rules/command_and_control_payload_download_via_applescript_applet.toml
+1 -1
View File
@@ -14,7 +14,7 @@ reference = [
"https://attack.mitre.org/techniques/T1553/001/",
"https://attack.mitre.org/techniques/T1105/",
]
version = "1.0.5"
version = "1.0.6"
query = '''
sequence by process.entity_id with maxspan=30s
behavior/rules/command_and_control_payload_downloaded_by_process_running_in_suspicious_directory.toml
+34 -17
View File
@@ -8,29 +8,46 @@ license = "Elastic License v2"
name = "Payload Downloaded by Process Running in Suspicious Directory"
os_list = ["macos"]
reference = ["https://attack.mitre.org/software/S0482/", "https://objective-see.com/blog/blog_0x69.html"]
version = "1.0.23"
version = "1.0.25"
query = '''
sequence by process.entity_id with maxspan=5s
[process where event.action == "exec" and
sequence by process.entity_id with maxspan=30s
[process where event.action == "exec" and
process.name == "curl" and process.args : "http*://*/*" and
descendant of [
process where event.action : ("exec", "fork") and
process where event.action : "exec" and
process.executable : (
"/private/tmp/*",
"/tmp/*",
"/Users/*/Library/Preferences/*"
)
] and
process.name == "curl" and
not process.args : ("https://omahaproxy.appspot.com/history",
"https://console.jumpcloud.com/api/systems/*",
"https://support-sp.apple.com/sp/product*",
"https://download.mozilla.org/*",
"https://*:443/logs-osquery_manager.result-default/*",
"https://www.mozilla.org/*",
"https://zoom.us/client/*")
"/Users/*/Library/Preferences/*",
"/Users/*/Library/Services/*",
"/var/tmp/*",
"/var/folders/*",
"/var/lib/*",
"/Users/Shared/*",
"/Library/Graphics/*",
"/Library/Containers/*",
"/Users/*/Library/Containers/*",
"/var/root/*",
"/Library/WebServer/*",
"/Library/Fonts/*")
] and not
process.args : ("https://omahaproxy.appspot.com/history",
"https://console.jumpcloud.com/api/systems/*",
"/usr/local/Homebrew/*",
"Homebrew/*",
"*/opt/homebrew/*",
"http*://*.jamfcloud.com/*",
"http*elastic.co*",
"http*localhost*",
"http*127.0.0.1*",
"http*0.0.0.0*",
"https://zoom.us/client/*") and
not process.parent.executable : ("/usr/local/munki/*",
"/System/*",
"/opt/homebrew/*",
"/Library/Management/*")
]
[network where event.action == "connection_attempted"]
[network where event.action == "connection_attempted" and process.name == "curl"]
'''
min_endpoint_version = "7.15.0"
behavior/rules/command_and_control_potential_execution_via_sliver_framework.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"https://github.com/BishopFox/sliver/blob/master/implant/sliver/shell/shell_windows.go#L39",
"https://github.com/BishopFox/sliver",
]
version = "1.0.11"
version = "1.0.12"
query = '''
process where event.action == "start" and
behavior/rules/command_and_control_potential_multi_architecture_file_downloads.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Potential Multi Architecture File Downloads"
os_list = ["linux"]
reference = ["https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai"]
version = "1.0.16"
version = "1.0.17"
query = '''
sequence by process.parent.entity_id with maxspan=5s
behavior/rules/command_and_control_potential_plugx_registry_modification.toml
+1 -1
View File
@@ -13,7 +13,7 @@ reference = [
"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/",
"https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx",
]
version = "1.0.19"
version = "1.0.20"
query = '''
registry where
behavior/rules/command_and_control_potential_vsingle_malware_infection.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"https://blogs.jpcert.or.jp/en/2021/03/Lazarus_malware3.html",
"https://blogs.jpcert.or.jp/en/2022/07/vsingle.html",
]
version = "1.0.17"
version = "1.0.18"
query = '''
process where event.action == "exec" and process.name : ("wget", "curl") and
behavior/rules/command_and_control_potential_wizardupdate_malware_infection.toml
+1 -1
View File
@@ -12,7 +12,7 @@ reference = [
"https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset",
"https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/",
]
version = "1.0.16"
version = "1.0.17"
query = '''
process where event.action == "exec" and
behavior/rules/command_and_control_potential_xcsset_malware_infection.toml
+1 -1
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Potential XCSSET Malware Infection"
os_list = ["macos"]
reference = ["https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset"]
version = "1.0.16"
version = "1.0.17"
query = '''
process where event.action == "exec" and
behavior/rules/command_and_control_remcos_rat_registry_or_file_modification.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Remcos RAT Registry or File Modification"
os_list = ["windows"]
reference = ["https://attack.mitre.org/software/S0332/", "https://any.run/malware-trends/remcos"]
version = "1.0.22"
version = "1.0.23"
query = '''
any where event.category : ("registry", "file") and
behavior/rules/command_and_control_shlayer_malware_infection.toml
+1 -1
View File
@@ -14,7 +14,7 @@ reference = [
"https://redcanary.com/threat-detection-report/threats/shlayer/",
"https://securelist.com/shlayer-for-macos/95724/",
]
version = "1.0.21"
version = "1.0.22"
query = '''
process where event.action == "exec" and process.name == "curl" and process.args : "-f0L"
behavior/rules/command_and_control_suspicious_command_and_control_via_internet_explorer.toml
+2 -2
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Suspicious Command and Control via Internet Explorer"
os_list = ["windows"]
reference = ["https://www.fortinet.com/blog/threat-research/new-variant-of-ursnif-continuously-targeting-italy"]
version = "1.0.20"
version = "1.0.22"
query = '''
sequence with maxspan=5m
@@ -22,7 +22,7 @@ sequence with maxspan=5m
"mshta.exe", "msbuild.exe", "installutil.exe")
) and
not (process.name : "wscript.exe" and process.args : "\\\\*") and
not (process.name : "wscript.exe" and process.args : ("\\\\*", "?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
not (process.name : "rundll32.exe" and
process.args : ("?:\\Windows\\System32\\inetcpl.cpl",
"?:\\Windows\\System32\\LogiLDA.dll,LogiFetch",
behavior/rules/command_and_control_suspicious_curl_file_download_via_osascript.toml
+39
View File
@@ -0,0 +1,39 @@
[rule]
description = """
Detects the execution of curl via osascript with the "-o" argument indicating a file download. This activity should be
highly abnormal and considered suspicious at least. Threat actors have consistently been seen utilizing this technique
to establish C2 or download additional payloads / tools.
"""
id = "883cbfd8-278a-403c-907a-aefb02da0429"
license = "Elastic License v2"
name = "Suspicious Curl File Download via Osascript"
os_list = ["macos"]
version = "1.0.2"
query = '''
process where event.type == "start" and
process.parent.name == "osascript" and process.name == "curl" and process.args in ("-o", "--output")
'''
min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.5.0"
behavior/rules/command_and_control_suspicious_curl_from_macos_application.toml
+1 -1
View File
@@ -13,7 +13,7 @@ reference = [
"https://objective-see.org/blog/blog_0x71.html#-vpn-trojan-covid",
"https://attack.mitre.org/techniques/T1105/",
]
version = "1.0.9"
version = "1.0.10"
query = '''
process where event.type == "start" and event.action == "exec" and
behavior/rules/command_and_control_suspicious_curl_to_google_app_script_endpoint.toml
+1 -1
View File
@@ -10,7 +10,7 @@ license = "Elastic License v2"
name = "Suspicious Curl to Google App Script Endpoint"
os_list = ["macos"]
reference = ["https://www.google.com/script/start/", "https://attack.mitre.org/techniques/T1105/"]
version = "1.0.9"
version = "1.0.10"
query = '''
process where event.type == "start" and process.name : "curl" and process.args : "https://script.google.com/*"
behavior/rules/command_and_control_suspicious_dns_query_from_mounted_virtual_disk.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "3bc98de7-3349-43ac-869c-58357ae2aac0"
license = "Elastic License v2"
name = "Suspicious DNS Query from Mounted Virtual Disk"
os_list = ["windows"]
version = "1.0.19"
version = "1.0.20"
query = '''
sequence by process.entity_id with maxspan=5m
behavior/rules/command_and_control_suspicious_dns_query_to_free_ssl_certificate_domains.toml
+2 -2
View File
@@ -7,13 +7,13 @@ id = "88f6c3d4-112e-4fad-b3ef-33095c954b63"
license = "Elastic License v2"
name = "Suspicious DNS Query to Free SSL Certificate Domains"
os_list = ["windows"]
version = "1.0.13"
version = "1.0.14"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
(
process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB *") or
(process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB *") and not process.executable : "C:\\*") or
process.executable :
("?:\\Windows\\system32\\*",
"?:\\Windows\\SysWOW64\\*",
behavior/rules/command_and_control_suspicious_executable_file_creation.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "37c54ca7-e96d-4fd5-92d3-08cab38516b7"
license = "Elastic License v2"
name = "Suspicious Executable File Creation"
os_list = ["windows"]
version = "1.0.13"
version = "1.0.14"
query = '''
file where event.action != "deletion" and not user.id : "S-1-5-18" and
behavior/rules/command_and_control_suspicious_netsupport_execution.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Suspicious NetSupport Execution"
os_list = ["windows"]
reference = ["https://www.netsupportsoftware.com/"]
version = "1.0.21"
version = "1.0.22"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/credential_access_access_to_browser_credentials_from_suspicious_memory.toml
+13 -3
View File
@@ -7,7 +7,7 @@ id = "808395cd-fb50-4eba-846c-aabcf212c256"
license = "Elastic License v2"
name = "Access to Browser Credentials from Suspicious Memory"
os_list = ["windows"]
version = "1.0.11"
version = "1.0.13"
query = '''
file where event.type == "access" and process.pid != 4 and
@@ -31,8 +31,18 @@ file where event.type == "access" and process.pid != 4 and
not (process.code_signature.trusted == true and
process.code_signature.subject_name :
("Trichilia Consultants Limited", "Bitdefender SRL", "Opera Norway AS", "FireEye, Inc.",
"Mozilla Corporation", "Google LLC")) and
not process.executable : "?:\\Program Files (x86)\\VMware\\Plug-in Service\\certutil.exe"
"Mozilla Corporation", "Google LLC", "Rapid7 LLC", "Cybereason, Inc", "Watchdata Technologies Pte. Ltd.")) and
not process.executable : "?:\\Program Files (x86)\\VMware\\Plug-in Service\\certutil.exe" and
not _arraysearch(process.thread.Ext.call_stack, $entry,
$entry.symbol_info : ("?:\\Program Files\\*.dll*",
"?:\\Program Files (x86)\\*.dll*",
"?:\\windows\\system32\\*\\tmmon*.dll*",
"?:\\Windows\\SysWOW64\\esensordbi.dll*",
"?:\\Windows\\System32\\esensordbi.dll*",
"?:\\Windows\\System32\\umppc*.dll*",
"?:\\Windows\\FireEye\\AppMonitorDll*.dll*",
"?:\\Windows\\apppatch\\AppPatch*\\exploitblocker.dll*",
"?:\\windows\\system32\\hmpalert.dll!*"))
'''
min_endpoint_version = "8.7.0"
behavior/rules/credential_access_access_to_windows_passwords_vault_via_powershell.toml
+1 -1
View File
@@ -10,7 +10,7 @@ os_list = ["windows"]
reference = [
"https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.passwordvault.retrieve?view=winrt-22000",
]
version = "1.0.21"
version = "1.0.22"
query = '''
process where event.action == "start" and
behavior/rules/credential_access_autologons_access_attempt_via_registry.toml
+59
View File
@@ -0,0 +1,59 @@
[rule]
description = """
Identifies attempts to access AutoLogons credentials via registry value query. Adversaries may search local file systems
and remote file shares for files containing insecurely stored credentials.
"""
id = "c0a977b4-1342-4794-9cd2-5d726c26c1b9"
license = "Elastic License v2"
name = "AutoLogons Access Attempt via Registry"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/SharpUp/blob/master/SharpUp/Checks/RegistryAutoLogons.cs#L26"]
version = "1.0.3"
query = '''
registry where event.action == "query" and process.executable != null and
registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\DefaultPassword" and
not process.executable :
("?:\\Windows\\System32\\LogonUI.exe",
"?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
"?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe",
"?:\\Windows\\System32\\MusNotification.exe",
"?:\\Windows\\SysWOW64\\MusNotification.exe",
"?:\\Windows\\regedit.exe",
"?:\\Program Files\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\Windows\\System32\\WindowsPowerShell\\v*\\powershell.exe",
"?:\\Windows\\System32\\WindowsPowerShell\\v*\\powershell_ise.exe") and
not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*")
'''
min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.6.0"
behavior/rules/credential_access_browser_debugging_from_unusual_parent.toml
+1 -1
View File
@@ -15,7 +15,7 @@ reference = [
"https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e",
"https://github.com/BishopFox/sliver/wiki/Cursed",
]
version = "1.0.12"
version = "1.0.13"
query = '''
process where event.type == "start" and
behavior/rules/credential_access_credential_access_via_known_utilities.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Credential Access via Known Utilities"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/"]
version = "1.0.32"
version = "1.0.33"
query = '''
process where event.action == "start" and
behavior/rules/credential_access_dumping_account_hashes_via_built_in_commands.toml
+1 -1
View File
@@ -12,7 +12,7 @@ reference = [
"https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored",
"https://www.unix.com/man-page/osx/8/mkpassdb/",
]
version = "1.0.21"
version = "1.0.22"
query = '''
process where event.type == "start" and
behavior/rules/credential_access_failed_access_attempt_to_web_browser_files.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "ebbb46d3-eb7f-4247-88fe-9bc5525443b3"
license = "Elastic License v2"
name = "Failed Access Attempt to Web Browser Files"
os_list = ["windows"]
version = "1.0.13"
version = "1.0.14"
query = '''
file where event.type == "access" and event.outcome == "failure" and process.pid != 4 and
behavior/rules/credential_access_failed_attempts_to_access_sensitive_files.toml
+3 -4
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Failed Attempts to Access Sensitive Files"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
version = "1.0.15"
version = "1.0.17"
query = '''
any where event.category in ("registry", "file") and
@@ -34,9 +34,8 @@ any where event.category in ("registry", "file") and
"?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\cookies.sqlite",
"?:\\Users\\*\\AppData\\*\\Firefox\\Profiles\\*\\key?.db") and
not process.executable :
("?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\osqueryd.exe",
"?:\\Program Files (x86)\\Transaction Data\\Rx30 Connect\\plink.exe",
"?:\\Program Files (x86)\\Microsoft SDKs\\Azure\\CLI2\\python.exe",
("?:\\Program Files\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\Windows\\System32\\SearchProtocolHost.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\OpenSSH\\ssh.exe") and
behavior/rules/credential_access_keychain_credential_files_collected_via_archive_utility.toml
+1 -1
View File
@@ -12,7 +12,7 @@ reference = [
"https://objective-see.com/blog/blog_0x25.html",
"https://securelist.com/calisto-trojan-for-macos/86543/",
]
version = "1.0.22"
version = "1.0.23"
query = '''
process where event.action == "exec" and process.name : ("zip", "tar") and
behavior/rules/credential_access_keychain_dump_via_native_security_tool.toml
+1 -1
View File
@@ -10,7 +10,7 @@ license = "Elastic License v2"
name = "Keychain Dump via native Security tool"
os_list = ["macos"]
reference = ["https://github.com/its-a-feature/LockSmith"]
version = "1.0.12"
version = "1.0.13"
query = '''
process where event.action == "exec" and
behavior/rules/credential_access_lsa_dump_via_silentprocessexit.toml
+1 -1
View File
@@ -10,7 +10,7 @@ os_list = ["windows"]
reference = [
"https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/",
]
version = "1.0.25"
version = "1.0.26"
query = '''
registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass*"
behavior/rules/credential_access_lsa_dump_via_windows_error_reporting.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "LSA Dump via Windows Error Reporting"
os_list = ["windows"]
reference = ["https://github.com/deepinstinct/Lsass-Shtinkering"]
version = "1.0.16"
version = "1.0.17"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/credential_access_lsass_access_attempt_from_an_unsigned_executable.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "6661d3b1-0baa-413c-9843-d83b8f9baaee"
license = "Elastic License v2"
name = "LSASS Access Attempt from an Unsigned Executable"
os_list = ["windows"]
version = "1.0.6"
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=5m
behavior/rules/credential_access_lsass_access_attempt_from_unbacked_memory.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "03efdaab-72af-4714-83ce-3abc10cab8d5"
license = "Elastic License v2"
name = "LSASS Access Attempt from Unbacked Memory"
os_list = ["windows"]
version = "1.0.6"
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=3m
behavior/rules/credential_access_lsass_memory_dump_via_minidumpwritedump.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "bdf280ea-d4d7-4f8f-90fc-0f44edad6b87"
license = "Elastic License v2"
name = "LSASS Memory dump via MiniDumpWriteDump"
os_list = ["windows"]
version = "1.0.6"
version = "1.0.7"
query = '''
any where event.category : "api" and
behavior/rules/credential_access_potential_access_to_kerberos_cached_credentials.toml
+1 -1
View File
@@ -12,7 +12,7 @@ reference = [
"https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py",
"https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html",
]
version = "1.0.20"
version = "1.0.21"
query = '''
process where event.type == "start" and
behavior/rules/credential_access_potential_credential_access_via_mimikatz.toml
+1 -1
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Potential Credential Access via Mimikatz"
os_list = ["windows"]
reference = ["https://adsecurity.org/?page_id=1821", "https://github.com/gentilkiwi/mimikatz"]
version = "1.0.21"
version = "1.0.22"
query = '''
process where event.action == "start" and
behavior/rules/credential_access_potential_credential_access_via_rubeus.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"https://github.com/GhostPack/Rubeus",
"https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_rubeus.yml",
]
version = "1.0.21"
version = "1.0.22"
query = '''
process where event.action == "start" and
behavior/rules/credential_access_potential_credential_access_via_windows_credential_history.toml
+1 -1
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Potential Credential Access via Windows Credential History"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.22"
version = "1.0.23"
query = '''
file where event.action == "open" and
behavior/rules/credential_access_potential_credentials_phishing_via_osascript.toml
+2 -1
View File
@@ -11,7 +11,7 @@ reference = [
"https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/prompt.py",
"https://ss64.com/osx/osascript.html",
]
version = "1.0.17"
version = "1.0.19"
query = '''
process where event.action == "exec" and
@@ -19,6 +19,7 @@ process where event.action == "exec" and
not (process.parent.executable : "/usr/bin/sudo" and process.command_line : "*Encryption Key Escrow*") and
not (process.command_line : "*-e with timeout of 3600 seconds*" and user.id == 0 and process.parent.executable : "/bin/bash") and
not process.Ext.effective_parent.executable : ("/usr/local/jamf/*",
"/Applications/Karabiner-Elements.app/Contents/MacOS/Karabiner-Elements",
"/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService")
behavior/rules/credential_access_potential_discovery_of_dpapi_master_keys.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Potential Discovery of DPAPI Master Keys"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.27"
version = "1.0.28"
query = '''
file where event.action == "open" and
behavior/rules/credential_access_potential_discovery_of_windows_credential_manager_store.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Potential Discovery of Windows Credential Manager Store"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.29"
version = "1.0.30"
query = '''
file where event.action == "open" and
behavior/rules/credential_access_security_account_manager_(sam)_file_access.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"https://adsecurity.org/?page_id=1821",
"https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
]
version = "1.0.25"
version = "1.0.26"
query = '''
file where event.action == "open" and
behavior/rules/credential_access_security_account_manager_(sam)_registry_access.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"https://adsecurity.org/?page_id=1821",
"https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
]
version = "1.0.24"
version = "1.0.25"
query = '''
sequence by process.entity_id
behavior/rules/credential_access_sensitive_file_access_cloud_credentials.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Sensitive File Access - Cloud Credentials"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt"]
version = "1.0.21"
version = "1.0.22"
query = '''
sequence by process.entity_id with maxspan=5m
behavior/rules/credential_access_sensitive_file_access_remote_desktop_connection_manager.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/",
"https://smsagent.blog/2017/01/26/decrypting-remote-desktop-connection-manager-passwords-with-powershell/",
]
version = "1.0.22"
version = "1.0.23"
query = '''
file where event.type == "access" and
behavior/rules/credential_access_sensitive_file_access_ssh_saved_keys.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Sensitive File Access - SSH Saved Keys"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
version = "1.0.27"
version = "1.0.28"
query = '''
any where event.category in ("registry", "file") and
behavior/rules/credential_access_sensitive_file_access_system_admin_utilities.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Sensitive File Access - System Admin Utilities"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
version = "1.0.22"
version = "1.0.23"
query = '''
sequence by process.entity_id with maxspan=5m
behavior/rules/credential_access_sensitive_file_access_unattended_panther.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"https://steflan-security.com/windows-privilege-escalation-credential-harvesting/",
"https://github.com/pha5matis/Pentesting-Guide/blob/master/privilege_escalation_windows.md",
]
version = "1.0.22"
version = "1.0.23"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/credential_access_suspicious_access_to_active_directory_database_file.toml
+1 -1
View File
@@ -10,7 +10,7 @@ os_list = ["windows"]
reference = [
"https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration",
]
version = "1.0.25"
version = "1.0.26"
query = '''
file where event.action == "open" and process.pid != 4 and
behavior/rules/credential_access_suspicious_access_to_lsa_secrets_registry.toml
+1 -1
View File
@@ -12,7 +12,7 @@ reference = [
"https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets",
"https://github.com/gtworek/PSBits/tree/master/LSASecretDumper",
]
version = "1.0.26"
version = "1.0.27"
query = '''
registry where
behavior/rules/credential_access_suspicious_access_to_web_browser_credential_stores.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "03758167-3eed-465f-9174-b284d599036d"
license = "Elastic License v2"
name = "Suspicious Access to Web Browser Credential Stores"
os_list = ["windows"]
version = "1.0.25"
version = "1.0.26"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/credential_access_suspicious_access_to_windows_vault_files.toml
+1 -1
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Suspicious Access to Windows Vault Files"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.22"
version = "1.0.23"
query = '''
file where event.action == "open" and
behavior/rules/credential_access_suspicious_credential_files_creation_via_kerberos.toml
+5 -4
View File
@@ -13,7 +13,7 @@ reference = [
"https://research.ifcr.dk/certipy-2-0-bloodhound-new-escalations-shadow-credentials-golden-certificates-and-more-34d1c26f0dc6",
"https://posts.specterops.io/certified-pre-owned-d95910965cd2",
]
version = "1.0.20"
version = "1.0.22"
query = '''
sequence by process.entity_id with maxspan=1m
@@ -32,10 +32,11 @@ sequence by process.entity_id with maxspan=1m
/* dumping PFX, CCACHE or KIRBI via kerberos */
(file.extension : ("ccache", "pfx", "kirbi") or file.Ext.header_bytes : ("0504*", "3082*", "768*")) and
not (process.name : "powershell.exe" and file.path : "?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\*")]
not (process.name : "powershell.exe" and file.path : "?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\*") and
not (process.code_signature.trusted == true and process.code_signature.subject_name : "KASEYA US LLC")]
'''
min_endpoint_version = "7.16.0"
min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
@@ -77,4 +78,4 @@ name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[internal]
min_endpoint_version = "7.16.0"
min_endpoint_version = "8.0.0"
behavior/rules/credential_access_suspicious_vault_client_image_load.toml
+3 -1
View File
@@ -10,7 +10,7 @@ os_list = ["windows"]
reference = [
"https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.passwordvault.retrieve?view=winrt-22000",
]
version = "1.0.20"
version = "1.0.21"
query = '''
sequence by process.entity_id with maxspan=1m
@@ -49,6 +49,8 @@ sequence by process.entity_id with maxspan=1m
"?:\\Program Files (x86)\\LabTech Client\\LTClient.exe",
"?:\\Users\\*\\AppData\\Local\\StarlimsBridge\\StarlimsBridge.exe",
"?:\\ProgramData\\LogiShrd\\LogiOptions\\Software\\Current\\LogiOptionsMgr.exe",
"?:\\Program Files\\LogiOptionsPlus\\logioptionsplus_agent.exe",
"?:\\Program Files (x86)\\LogiOptionsPlus\\logioptionsplus_agent.exe",
"?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe") and
not (process.name : ("powershell.exe", "mshta.exe") and process.working_directory : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
not process.executable :
behavior/rules/credential_access_suspicious_vault_files_access_via_rpc.toml
+2 -2
View File
@@ -10,7 +10,7 @@ os_list = ["windows"]
reference = [
"https://docs.microsoft.com/en-us/uwp/api/windows.security.credentials.passwordvault.retrieve?view=winrt-22000",
]
version = "1.0.9"
version = "1.0.10"
query = '''
sequence
@@ -20,7 +20,7 @@ sequence
((process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
(process.code_signature.trusted == false or process.code_signature.exists == false)) or
process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB*") or
(process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB*") and not process.executable : "C:\\*") or
(process.executable : ("?:\\Users\\Public\\*", "?:\\Windows\\Tasks\\*",
"?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*",
behavior/rules/credential_access_system_bootkey_registry_access.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"http://moyix.blogspot.com/2008/02/syskey-and-sam.html",
"https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
]
version = "1.0.21"
version = "1.0.22"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/credential_access_systemkey_access_via_command_line.toml
+1 -1
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "SystemKey Access via Command Line"
os_list = ["macos"]
reference = ["https://github.com/AlessandroZ/LaZagne/blob/master/Mac/lazagne/softwares/system/chainbreaker.py"]
version = "1.0.20"
version = "1.0.21"
query = '''
process where event.action == "exec" and
behavior/rules/credential_access_unusual_kerberos_client_process.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "b5c91c3e-9d2d-4df6-afb7-c9d236b5ebe2"
license = "Elastic License v2"
name = "Unusual Kerberos Client Process"
os_list = ["windows"]
version = "1.0.20"
version = "1.0.21"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/credential_access_unusual_ldap_client_process.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "968e989d-de58-48db-9a06-38a170090def"
license = "Elastic License v2"
name = "Unusual LDAP Client Process"
os_list = ["windows"]
version = "1.0.12"
version = "1.0.13"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/credential_access_web_browser_credential_access_via_unsigned_process.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "9ed4ee4a-bc91-4d38-b6dd-11467b774460"
license = "Elastic License v2"
name = "Web Browser Credential Access via Unsigned Process"
os_list = ["windows"]
version = "1.0.23"
version = "1.0.24"
query = '''
sequence by user.name with maxspan=2m
behavior/rules/credential_access_web_browser_credential_access_via_unusual_process.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "f488cd1b-2407-4ec8-8705-7adf99ccbd33"
license = "Elastic License v2"
name = "Web Browser Credential Access via Unusual Process"
os_list = ["windows"]
version = "1.0.21"
version = "1.0.22"
query = '''
file where event.type == "access" and
behavior/rules/credential_access_web_browser_credential_data_accessed_by_unsigned_or_untrusted_process.toml
+55
View File
@@ -0,0 +1,55 @@
[rule]
description = """
Identifies an unsigned process accessing the password store of commonly used web browsers. Adversaries may steal
credentials from web browsers by reading files specific to the target browser.
"""
id = "ca46963e-c632-44cb-bb3c-a5f17a2b2c56"
license = "Elastic License v2"
name = "Web Browser Credential Data Accessed by Unsigned or Untrusted Process"
os_list = ["macos"]
version = "1.0.3"
query = '''
file where event.action == "open" and process.executable != null and
file.name : ("cookies.sqlite",
"key?.db",
"logins.json",
"Cookies",
"Cookies.binarycookies",
"Login Data") and
(process.code_signature.trusted == false or process.code_signature.exists == false) and not
process.code_signature.signing_id : "org.mozilla.firefox"
'''
min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.8.0"
behavior/rules/credential_access_web_browsers_password_access_via_command_line.toml
+1 -1
View File
@@ -14,7 +14,7 @@ reference = [
"https://ss64.com/osx/security.html",
"https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/",
]
version = "1.0.21"
version = "1.0.22"
query = '''
process where event.action == "exec" and
behavior/rules/defense_evasion_amsi_or_wldp_bypass_via_memory_patching.toml
+66
View File
@@ -0,0 +1,66 @@
[rule]
description = """
Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface or Windows Lock Down
Policy related DLLs from memory. This may indicate an attempt to tamper with certain Windows native protections.
"""
id = "586bf106-b208-45fc-9401-727664175ca0"
license = "Elastic License v2"
name = "AMSI or WLDP Bypass via Memory Patching"
os_list = ["windows"]
reference = [
"https://aidenpearce369.github.io/offsec/AMSI-Memory-Bypass/",
"https://modexp.wordpress.com/2019/06/03/disable-amsi-wldp-dotnet/",
"https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/blob/master/README.md#Patch-the-providers-DLL-of-Microsoft-MpOav.dll",
]
version = "1.0.8"
query = '''
api where
((process.Ext.api.name : "VirtualProtect*" and process.Ext.api.parameters.protection : "*W*") or
process.Ext.api.name : "WriteProcessMemory*") and
process.Ext.api.summary : ("* amsi.dll*", "* mpoav.dll*", "* wldp.dll*") and
process.executable != null and process.parent.executable != null and process.thread.Ext.call_stack_summary : "?*" and
(
process.thread.Ext.call_stack_summary :
("ntdll.dll|kernelbase.dll|Unbacked",
"ntdll.dll|kernelbase.dll|Unknown",
"ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|*|_ctypes.pyd|python*.dll|Unknown|kernel32.dll|ntdll.dll") or
endswith~(process.thread.Ext.call_stack_summary, concat("ntdll.dll|kernelbase.dll|Unbacked|", process.name)) or
endswith~(process.thread.Ext.call_stack_summary, concat(concat("ntdll.dll|kernelbase.dll|Unbacked|", process.name), "|kernel32.dll|ntdll.dll"))
)
'''
min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.8.0"
behavior/rules/defense_evasion_attempt_to_disable_driver_via_hvcidisallowedimages.toml
+1 -1
View File
@@ -12,7 +12,7 @@ reference = [
"https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/device-guard-and-credential-guard",
"https://github.com/yardenshafir/conference_talks/blob/main/OffensiveCon_2023_Your_Mitigations_are_My_Opportunities.pdf",
]
version = "1.0.4"
version = "1.0.5"
query = '''
registry where registry.path : "HKLM\\SYSTEM\\*ControlSet*\\CI\\*HVCIDisallowedImages*"
behavior/rules/defense_evasion_attempt_to_disable_linux_security_and_logging_controls.toml
+1 -1
View File
@@ -8,7 +8,7 @@ id = "b63df89d-ac6f-44d7-80fa-ddf038295e42"
license = "Elastic License v2"
name = "Attempt to Disable Linux Security and Logging Controls"
os_list = ["linux"]
version = "1.0.16"
version = "1.0.17"
query = '''
process where event.type=="start" and
behavior/rules/defense_evasion_attempt_to_disable_windows_defender_services.toml
+1 -1
View File
@@ -4,7 +4,7 @@ id = "32ab2977-2932-4172-9117-36e382591818"
license = "Elastic License v2"
name = "Attempt to Disable Windows Defender Services"
os_list = ["windows"]
version = "1.0.20"
version = "1.0.21"
query = '''
process where event.action == "start" and
behavior/rules/defense_evasion_attempt_to_disable_windows_driver_blocklist_via_registry.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules",
"https://www.unknowncheats.me/forum/anti-cheat-bypass/524561-windows-11-blacklisteddrivers-fix.html",
]
version = "1.0.10"
version = "1.0.11"
query = '''
registry where registry.path : "HKLM\\SYSTEM\\*ControlSet*\\CI\\Config\\VulnerableDriverBlocklistEnable" and
behavior/rules/defense_evasion_binary_masquerading_via_untrusted_path.toml
+6 -3
View File
@@ -8,7 +8,7 @@ id = "35dedf0c-8db6-4d70-b2dc-a133b808211f"
license = "Elastic License v2"
name = "Binary Masquerading via Untrusted Path"
os_list = ["windows"]
version = "1.0.35"
version = "1.0.37"
query = '''
process where event.action == "start" and
@@ -31,6 +31,7 @@ process where event.action == "start" and
"eventvwr.exe",
"ieexec.exe",
"installutil.exe",
"RegAsm.exe",
"ipconfig.exe",
"lsass.exe",
"Microsoft.Workflow.Compiler.exe",
@@ -49,7 +50,6 @@ process where event.action == "start" and
"qprocess.exe",
"quser.exe",
"qwinsta.exe",
"regasm.exe",
"regsvcs.exe",
"regsvr32.exe",
"rundll32.exe",
@@ -165,7 +165,10 @@ process where event.action == "start" and
"?:\\CAMS\\Enterprise\\CAMSServices\\ServiceBroker\\RegAsm.exe",
"?:\\Witron\\wms\\rt\\axl\\runtime\\bin\\system\\tools\\RegAsm.exe",
"?:\\SpearTrayApplication\\Tray\\regsvr32.exe",
"?:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\*\\RegAsm.exe") and
"?:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\*\\RegAsm.exe",
"*\\Visual Studio\\*\\Bin\\MSBuild.exe",
"C:\\Sage\\Sage300\\Online\\Worker\\InstallUtil.exe",
"C:\\AssessPro\\Programs\\RegAsm.exe") and
not (process.name : "regsvr32.exe" and process.parent.name : "rundll32.exe" and
process.parent.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*") and
not (process.code_signature.subject_name : "JetBrains s.r.o." and process.code_signature.trusted == true) and
behavior/rules/defense_evasion_binary_proxy_execution_via_rundll32.toml
+1 -1
View File
@@ -16,7 +16,7 @@ reference = [
"https://lolbas-project.github.io/lolbas/Libraries/Url/",
"https://lolbas-project.github.io/lolbas/Libraries/Desk/",
]
version = "1.0.24"
version = "1.0.25"
query = '''
sequence with maxspan=1m
behavior/rules/defense_evasion_common_language_runtime_loaded_via_an_unsigned_module.toml
+1 -1
View File
@@ -4,7 +4,7 @@ id = "d8d90a1a-a912-4716-994b-26e24d363d76"
license = "Elastic License v2"
name = "Common Language Runtime Loaded via an Unsigned Module"
os_list = ["windows"]
version = "1.0.10"
version = "1.0.11"
query = '''
sequence by process.entity_id with maxspan=1m
behavior/rules/defense_evasion_control_panel_process_with_unusual_arguments.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "a4862afb-1292-4f65-a15f-8d6a8019b5e2"
license = "Elastic License v2"
name = "Control Panel Process with Unusual Arguments"
os_list = ["windows"]
version = "1.0.23"
version = "1.0.24"
query = '''
process where event.action == "start" and
behavior/rules/defense_evasion_crashdump_disabled_via_registry_modification.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"https://elastic.github.io/security-research/intelligence/2022/03/01.hermeticwiper-targets-ukraine/article/",
"https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options",
]
version = "1.0.23"
version = "1.0.24"
query = '''
registry where registry.value : "CrashDumpEnabled" and registry.data.strings : "0" and
behavior/rules/defense_evasion_decoded_or_decrypted_payload_written_to_suspicious_directory.toml
+1 -1
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Decoded or Decrypted Payload Written to Suspicious Directory"
os_list = ["macos"]
reference = ["https://attack.mitre.org/software/S0482/"]
version = "1.0.22"
version = "1.0.23"
query = '''
process where event.action == "exec" and
behavior/rules/defense_evasion_defense_evasion_via_registry_modification.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "e3938d6e-8f66-4871-88c7-442a530f8119"
license = "Elastic License v2"
name = "Defense Evasion via Registry Modification"
os_list = ["windows"]
version = "1.0.15"
version = "1.0.16"
query = '''
registry where not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
behavior/rules/defense_evasion_delayed_load_of_a_windows_network_module.toml
+85
View File
@@ -0,0 +1,85 @@
[rule]
description = """
Identifies attempts to load a Windows network DLL with a delay of at least 5 minutes after the process started. This may
indicate an attempt to evade detection via time based evasion techniques or execution of extra post exploitation modules
that requires those DLLs.
"""
id = "9bbcc138-3adb-41a5-b61a-787260b6492d"
license = "Elastic License v2"
name = "Delayed Load of a Windows Network Module"
os_list = ["windows"]
version = "1.0.3"
query = '''
sequence by process.entity_id with maxspan=1m
[library where process.uptime >= 300 and
dll.name : ("ws2_32.dll", "wininet.dll", "winhttp.dll", "msxml3.dll") and
not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
process.thread.Ext.call_stack_summary : "?*" and
(
process.name : ("wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe") or
(process.executable : "?:\\Users\\*" and (process.code_signature.status : "errorBadDigest" or process.code_signature.exists == false))
) and
not (process.name : ("rundll32.exe", "regsvr32.exe") and
_arraysearch(process.thread.Ext.call_stack, $entry,
$entry.symbol_info : ("?:\\Program Files\\*.dll*",
"?:\\Program Files (x86)\\*.dll*",
"?:\\Windows\\assembly\\NativeImages*",
"?:\\Windows\\System32\\DriverStore*",
"?:\\Windows\\Sys*\\TSWorkspace.dll!*",
"?:\\Windows\\SysWOW64\\f_policy.dll!LoginFSNEx*"))) and
not (dll.name : "msxml3.dll" and not process.name : ("cscript.exe", "wscript.exe"))
]
[network where event.action == "connection_attempted" and
network.direction == "egress" and network.transport == "tcp" and
source.port >= 49152 and not destination.address : ("127.*", "::1")]
'''
min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1497"
name = "Virtualization/Sandbox Evasion"
reference = "https://attack.mitre.org/techniques/T1497/"
[[threat.technique.subtechnique]]
id = "T1497.003"
name = "Time Based Evasion"
reference = "https://attack.mitre.org/techniques/T1497/003/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique]]
id = "T1573"
name = "Encrypted Channel"
reference = "https://attack.mitre.org/techniques/T1573/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.8.0"
behavior/rules/defense_evasion_direct_syscall_via_assembly_bytes.toml
-72
View File
@@ -1,72 +0,0 @@
[rule]
description = """
Identifies attempts to call a System call directly using assembly instructions and from unusual native system module
ntdll. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.
"""
id = "e0abc200-a578-4e3a-bd1a-eded0c32a245"
license = "Elastic License v2"
name = "Direct Syscall via Assembly Bytes"
os_list = ["windows"]
version = "1.0.2"
query = '''
any where
(
(event.category : ("library", "api", "registry", "file") and
process.thread.Ext.call_stack_summary : "?*" and not process.thread.Ext.call_stack_summary : "ntdll.dll*" and
/* mov r10,rcx, mov eax,ssn, syscall */
_arraysearch(process.thread.Ext.call_stack, $entry,
($entry.callsite_trailing_bytes : ("*4c8bd1b8??????000f05", "*4989cab8??????000f05", "*4c8bd10f05", "*4989ca0f05") or
$entry.callsite_leading_bytes : ("*4c8bd1b8??????000f05", "*4989cab8??????000f05", "*4c8bd10f05", "*4989ca0f05")))) or
(event.category : "process" and
process.parent.thread.Ext.call_stack_summary : "?*" and not process.parent.thread.Ext.call_stack_summary : "ntdll.dll*" and
/* mov r10,rcx, mov eax,ssn, syscall */
_arraysearch(process.parent.thread.Ext.call_stack, $entry,
($entry.callsite_trailing_bytes : ("*4c8bd1b8??????000f05", "*4989cab8??????000f05", "*4c8bd10f05", "*4989ca0f05") or
$entry.callsite_leading_bytes : ("*4c8bd1b8??????000f05", "*4989cab8??????000f05", "*4c8bd10f05", "*4989ca0f05"))))
) and
not process.executable :
("?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
"?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
"?:\\Program Files\\Mozilla Firefox\\firefox.exe",
"?:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe") and
not (process.code_signature.subject_name : ("Google LLC", "Mozilla Corporation") and process.code_signature.trusted == true) and
/* chromium and last one for Acrobat */
not _arraysearch(process.thread.Ext.call_stack, $entry,
$entry.callsite_trailing_bytes :
("c3cd2ec30f1f84000000000000000000000000000000000000000000000000000000000000000000000000004c8bd1b82a000000f604250803fe7f0175030f05",
"c3cd2ec30f1f8400000000004c8bd1b829000000f604250800000000000000000000000000000000000000004c8bd1b82a000000f604250803fe7f0175030f05",
"c3cd2ec30f1f84000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
"c30f1f4400004c8bd1b8280000000f05c30f1f44000000000000000000000000000000000000000000000000000000000000000000004c8bd1b8290000000f05",
"c30f1f4400004c8bd1b8280000000f05c30f1f4400004c8bd1b8290000000f05c30f00000000000000000000000000000000000000004c8bd1b8290000000f05",
"c30f1f440000ff25000000007004fd89ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
'''
min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.8.0"
behavior/rules/defense_evasion_disabling_hypervisor_protected_code_integrity_via_registry.toml
+1 -1
View File
@@ -11,7 +11,7 @@ reference = [
"https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/",
"https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity",
]
version = "1.0.10"
version = "1.0.11"
query = '''
registry where event.action == "modification" and
behavior/rules/defense_evasion_dll_control_panel_items_registry_modification.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "DLL Control Panel Items Registry Modification"
os_list = ["windows"]
reference = ["https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/hh127454(v=vs.85)"]
version = "1.0.17"
version = "1.0.18"
query = '''
registry where
behavior/rules/defense_evasion_dll_dropped_by_msiexec_followed_by_sideload.toml
+1 -1
View File
@@ -7,7 +7,7 @@ id = "1543ed0b-2d7b-42f9-93d2-bf9bfd8759e3"
license = "Elastic License v2"
name = "DLL Dropped by MSIEXEC followed by SideLoad"
os_list = ["windows"]
version = "1.0.14"
version = "1.0.15"
query = '''
sequence by user.id with maxspan=1m
behavior/rules/defense_evasion_dll_execution_via_visual_studio_live_share.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "DLL Execution via Visual Studio Live Share"
os_list = ["windows"]
reference = ["https://twitter.com/bohops/status/1583916360404729857"]
version = "1.0.16"
version = "1.0.17"
query = '''
process where event.action == "start" and
behavior/rules/defense_evasion_dll_side_loading_of_a_file_dropped_by_microsoft_office.toml
+1 -1
View File
@@ -8,7 +8,7 @@ id = "68218637-3940-42cb-b2b7-0610fc1dde56"
license = "Elastic License v2"
name = "DLL Side Loading of a file dropped by Microsoft Office"
os_list = ["windows"]
version = "1.0.12"
version = "1.0.13"
query = '''
sequence with maxspan=5m
behavior/rules/defense_evasion_dll_side_loading_via_a_copied_microsoft_executable.toml
+1 -1
View File
@@ -11,7 +11,7 @@ os_list = ["windows"]
reference = [
"https://www.microsoft.com/en-us/security/blog/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/",
]
version = "1.0.12"
version = "1.0.13"
query = '''
sequence by user.id with maxspan=5m
behavior/rules/defense_evasion_dylib_load_with_suspicious_code_signature.toml
+1 -1
View File
@@ -10,7 +10,7 @@ id = "c5681e08-0c25-4030-b306-c67efc36d324"
license = "Elastic License v2"
name = "Dylib Load with Suspicious Code Signature"
os_list = ["macos"]
version = "1.0.7"
version = "1.0.8"
query = '''
any where event.action == "load" and
behavior/rules/defense_evasion_dylib_loaded_by_process_in_suspicious_location.toml
+1 -1
View File
@@ -10,7 +10,7 @@ id = "b97ecb91-b4bb-480e-a855-47f2a9ec107c"
license = "Elastic License v2"
name = "Dylib Loaded by Process in Suspicious Location"
os_list = ["macos"]
version = "1.0.10"
version = "1.0.11"
query = '''
any where event.action == "load" and
behavior/rules/defense_evasion_elastic_endpoint_security_kernel_extension_unload.toml
+1 -1
View File
@@ -4,7 +4,7 @@ id = "a412fd9b-2a06-49ff-a073-8eb313c2d930"
license = "Elastic License v2"
name = "Elastic Endpoint Security Kernel Extension Unload"
os_list = ["macos"]
version = "1.0.22"
version = "1.0.23"
query = '''
process where event.type == "start" and
behavior/rules/defense_evasion_evasion_via_double_file_extension.toml
+1 -1
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Evasion via Double File Extension"
os_list = ["windows"]
reference = ["https://www.pcmag.com/encyclopedia/term/double-extension"]
version = "1.0.20"
version = "1.0.21"
query = '''
process where event.action == "start" and
behavior/rules/defense_evasion_evasion_via_event_tracing_for_windows_patching.toml
+1 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Evasion via Event Tracing for Windows Patching"
os_list = ["windows"]
reference = ["https://blog.xpnsec.com/hiding-your-dotnet-etw/"]
version = "1.0.4"
version = "1.0.5"
query = '''
api where process.Ext.api.summary : ("*ntdll.dll!Etw*", "*ntdll.dll!NtTrace*")

Some files were not shown because too many files have changed in this diff Show More