admin/elastic-protections-artifacts
1
0
Fork 0
mirror of https://github.com/elastic/protections-artifacts synced 2026-06-08 14:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

open protections artifacts

Browse Source
This commit is contained in:
Mika Ayenson
2022-07-29 10:41:48 -04:00
parent ee9ae22c0f
commit 1aa0f3dc9b
563 changed files with 37662 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitattributes
+3
View File
@@ -0,0 +1,3 @@
*.yar text eol=lf
*.toml text eol=lf
*.lua text eol=lf
.github/ISSUE_TEMPLATE/behavior_bug_issue.md
+31
View File
@@ -0,0 +1,31 @@
---
name: Behavior - Report a bug within the endpoint rule
about: Report a bug for the endpoint security artifact
title: "[Bug] Name of behavior rule"
labels: bug, behavior
assignees: ''
---
**Describe the bug**
A clear and concise description of what the bug is.
**To Reproduce**
Steps to reproduce the behavior:
1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error
**Expected behavior**
A clear and concise description of what you expected to happen.
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Desktop (please complete the following information):**
- OS:
- Version:
**Additional context**
Add any other context about the problem here.
.github/ISSUE_TEMPLATE/behavior_custom_issue.md
+34
View File
@@ -0,0 +1,34 @@
---
name: Behavior - Report a custom issue
about: Custom Issue reported
title: "[Custom]: Concise title"
labels: custom, behavior
assignees: ''
---
## Description
Provide a detailed description of the issue.
## Optional Info
- **Screenshots**
- **Example Data**
Any available data or timeline information here, pasted or attached:
```json
{
"paste_dataz": "here"
}
```
- **Additional Requirements**
Any additional configuration required for the query to work (e.g. sysmon, config modification, etc.)
## References
- https://sample.link.com/
.github/ISSUE_TEMPLATE/yara_request_coverage.md
+29
View File
@@ -0,0 +1,29 @@
---
name: YARA - Request for coverage on malware family
about: Suggestion for YARA coverage for malware family
title: "[Request for Coverage] Malware Family Name"
labels: yara, Request for Coverage
assignees: ''
---
<!-- Before submitting an issue to request coverage, please make sure the rule doesn’t currently have coverage within our repository. We are interested to hear about new families or malware that doesn’t currently have coverage within our rules. Please note, there is an unlimited supply of malware out there, and our team has to prioritize what families to target, we are currently focused on global threats impacting multiple organizations and the general population. We may not be able to implement coverage for every request, but we will try hard to review each request and consider new coverage. --->
## Request for Coverage Details
Malware Family Name:
## Description
<!-- Provide a detailed description and context around the malware family that is being suggested for coverage. Any kind of reference to existing threat research is really helpful for our team. --->
## Example Sample
<!-- In order to create new coverage for a malware family, please share the sample link via [VirusTotal](https://www.virustotal.com/gui/home/search) or other community sharing sites such as [MalwareBazaar](https://bazaar.abuse.ch/browse/) or [MalShare](https://malshare.com/). -->
## Optional Info
If you are further along in the analysis process and have working YARA rule for a set of samples. Feel free to also send that over to help augment our team's analysis into writing a new rule.
```json
{
"Insert YARA rule here"
}
```
.github/ISSUE_TEMPLATE/yara_rule_tuning.md
+22
View File
@@ -0,0 +1,22 @@
---
name: YARA - Report an existing rule for tuning
about: Suggestion for logic changes to an existing YARA rule
title: "[Rule Tuning] Name of YARA rule"
labels: yara, Tuning
assignees: ''
---
<!-- Before submitting an issue to tune a rule, be sure to review CONTRIBUTING.md --->
<!-- Example Impacted Rule --->
<!-- Rule Name: Windows_Trojan_CobaltStrike_59ed9124 --->
## Impacted Rule:
Rule Name with ID:
## Description
<!-- Provide a detailed description of the suggested changes including any important details or context why the rule needs to be fixed. Any kind of alert volume within the specific time period and the number of endpoints impacted is super helpful. For example, this YARA rule is hitting on a signed Windows executable (svchost.exe) and has been triggered 200 times in the last 7 days on 5 different endpoints. --->
## Example Sample
<!-- We are happy to look into false positives and rule tunings. In order to do this we need to validate the request with a sample and verify the data along with the rule. Please provide a link to the sample within [VirusTotal](https://www.virustotal.com/gui/home/search). If the sample cannot be shared publicly, engage with us on our community Slack or email us directly. -->
.github/workflows/duplicate_issue.yml
+34
View File
@@ -0,0 +1,34 @@
on:
issues:
types: [opened]
name: Duplicate Open Issue to Internal Repo
jobs:
post_new_issue:
runs-on: ubuntu-latest
steps:
- name: Duplicate issue to internal behavior repo
uses: octokit/request-action@v2.x
if: contains(github.event.issue.labels.*.name, 'behavior')
with:
route: POST /repos/{owner}/{repo}/issues
owner: elastic
repo: endpoint-rules
title: "${{ toJSON(format('{0} {1}', '[Openness Issue]', github.event.issue.title ))}}"
body: ${{toJSON(github.event.issue.body)}}
labels: ${{toJSON(github.event.issue.labels)}}
env:
GITHUB_TOKEN: ${{ secrets.PROTECTIONS_MACHINE_TOKEN }}
- name: Duplicate issue to internal yara repo
uses: octokit/request-action@v2.x
if: contains(github.event.issue.labels.*.name, 'yara')
with:
route: POST /repos/{owner}/{repo}/issues
owner: elastic
repo: protections-yara-rules
title: "${{ toJSON(format('{0} {1}', '[Openness Issue]', github.event.issue.title ))}}"
body: ${{toJSON(github.event.issue.body)}}
labels: ${{toJSON(github.event.issue.labels)}}
env:
GITHUB_TOKEN: ${{ secrets.PROTECTIONS_MACHINE_TOKEN }}
.gitignore
+1
View File
@@ -0,0 +1 @@
.DS_Store
LICENSE.txt
+93
View File
@@ -0,0 +1,93 @@
Elastic License 2.0
URL: https://www.elastic.co/licensing/elastic-license
## Acceptance
By using the software, you agree to all of the terms and conditions below.
## Copyright License
The licensor grants you a non-exclusive, royalty-free, worldwide,
non-sublicensable, non-transferable license to use, copy, distribute, make
available, and prepare derivative works of the software, in each case subject to
the limitations and conditions below.
## Limitations
You may not provide the software to third parties as a hosted or managed
service, where the service provides users with access to any substantial set of
the features or functionality of the software.
You may not move, change, disable, or circumvent the license key functionality
in the software, and you may not remove or obscure any functionality in the
software that is protected by the license key.
You may not alter, remove, or obscure any licensing, copyright, or other notices
of the licensor in the software. Any use of the licensor’s trademarks is subject
to applicable law.
## Patents
The licensor grants you a license, under any patent claims the licensor can
license, or becomes able to license, to make, have made, use, sell, offer for
sale, import and have imported the software, in each case subject to the
limitations and conditions in this license. This license does not cover any
patent claims that you cause to be infringed by modifications or additions to
the software. If you or your company make any written claim that the software
infringes or contributes to infringement of any patent, your patent license for
the software granted under these terms ends immediately. If your company makes
such a claim, your patent license ends immediately for work on behalf of your
company.
## Notices
You must ensure that anyone who gets a copy of any part of the software from you
also gets a copy of these terms.
If you modify the software, you must include in any modified copies of the
software prominent notices stating that you have modified the software.
## No Other Rights
These terms do not imply any licenses other than those expressly granted in
these terms.
## Termination
If you use the software in violation of these terms, such use is not licensed,
and your licenses will automatically terminate. If the licensor provides you
with a notice of your violation, and you cease all violation of this license no
later than 30 days after you receive that notice, your licenses will be
reinstated retroactively. However, if you violate these terms after such
reinstatement, any additional violation of these terms will cause your licenses
to terminate automatically and permanently.
## No Liability
*As far as the law allows, the software comes as is, without any warranty or
condition, and the licensor will not be liable to you for any damages arising
out of these terms or the use or nature of the software, under any kind of
legal claim.*
## Definitions
The **licensor** is the entity offering these terms, and the **software** is the
software the licensor makes available under these terms, including any portion
of it.
**you** refers to the individual or entity agreeing to these terms.
**your company** is any legal entity, sole proprietorship, or other kind of
organization that you work for, plus all organizations that have control over,
are under the control of, or are under common control with that
organization. **control** means ownership of substantially all the assets of an
entity, or the power to direct its management and policies by vote, contract, or
otherwise. Control can be direct or indirect.
**your licenses** are all the licenses granted to you for the software under
these terms.
**use** means anything you do with the software requiring one of your licenses.
**trademark** means trademarks, service marks, and similar rights.
README.md
+27 -1
View File
@@ -1 +1,27 @@
# protections-artifacts
<h1><img src="https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt786d938064f8c8be/5e0e7b96fb35e665aed32798/logo-endpoint-32-color.svg"/> Protections Artifacts</h1>
Elastic Security prevents ransomware and malware, detects advanced threats, and arms responders with vital context. It’s free and open, ready for every endpoint.
Protections-Artifacts is the home of our detection logic (rules, yara, etc) for [Elastic Security for endpoint](https://www.elastic.co/security/endpoint-security). At Elastic, we believe that being open and transparent is critical for the success of us and our users. Check out our [blog post](https://www.elastic.co/security-labs/) if you are interested in additional background.
# Directory
Below you will find the artifacts we have opened in this repository:
| Folder | Description |
| ------ | ----------- |
| [`behavior/`](behavior/) | EQL based malicious behavior rules |
| [`yara/`](yara) | Yara rules for malware protection |
# Questions? Problems? Suggestions?
If you would like you to provide feedback or contribute to this repository, please familiarize yourself with the applicable artifact’s readme and [open an issue](https://github.com/elastic/protections-artifacts/issues/new/choose) using one of the provided templates. We cannot accept pull requests at this time because this repository is automatically generated.
You can also reach us in our [Slack Workspace](https://www.elastic.co/blog/join-our-elastic-stack-workspace-on-slack) or in the [Security Discuss](https://discuss.elastic.co/c/security/) forum.
# License
Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements. Licensed under the Elastic License 2.0; you may not use these artifacts except in compliance with the Elastic License 2.0
Contributors must sign a [Contributor License Agreement](https://www.elastic.co/contributor-agreement) before contributing code to any Elastic repositories.
behavior/README.md
+55
View File
@@ -0,0 +1,55 @@
## Elastic Security Malicious Behavior Protection Rules
Prebuilt high signal [EQL](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) rules that runs on the endpoint to disrupt malicious behavior, this layer of prevention equips Elastic Agent to protect Linux, Windows, and macOS hosts from a broad range of attack techniques with a major focus on the following tactics :
- [Initial Access](https://attack.mitre.org/tactics/TA0001/)
- [Execution](https://attack.mitre.org/tactics/TA0002/)
- [Privilege Escalation](https://attack.mitre.org/tactics/TA0004/)
- [Defense Evasion](https://attack.mitre.org/tactics/TA0005/)
- [Credential Access](https://attack.mitre.org/tactics/TA0006/)
- [Impact](https://attack.mitre.org/tactics/TA0040/)
Prevention is achieved by pairing post-execution analytics with response actions to kill a specific process or a full process tree tailored to stop the adversary at the initial stages of the attack. Each protection rule is mapped to the most relevant [MITRE ATT&CK](https://attack.mitre.org/) tactic, technique and subtechnique.
The true positive rate that we aim to maintain is at least 70%, thus we prioritize analytics logic precision to reduce detection scope via prevention.
Another example of our commitment to openness in security is our existing public [Detection Rules](https://github.com/elastic/detection-rules) repository where we share [EQL](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) rules that run on the SIEM side, and that have a broader detection logic which make them more suitable for detection and hunting.
### Rules Summary per Tactic
<!-- python -m endpoint_rules rule-stats-summary --release-version latest 1.0.2 -->
Note: New Production Rules since last version ('latest', '1.0.2') by OS/MITRE Tactic.
| Tactic | Windows | Linux | macOS | Total by Tactic |
|----------------------|-----------|---------|---------|-------------------|
| Credential Access | 16 | 0 | 4 | 20 |
| Discovery | 0 | 1 | 2 | 3 |
| Execution | 8 | 0 | 0 | 8 |
| Defense Evasion | 12 | 0 | 3 | 15 |
| Impact | 3 | 0 | 0 | 3 |
| Privilege Escalation | 4 | 1 | 1 | 6 |
| Initial Access | 5 | 0 | 0 | 5 |
| Command and Control | 3 | 0 | 0 | 3 |
| Lateral Movement | 3 | 0 | 1 | 4 |
| Persistence | 1 | 0 | 1 | 2 |
| Total by OS | 55 | 2 | 12 | 69 |
Note: Latest Total Production Rules by OS/MITRE Tactic.
| Tactic | Windows | Linux | macOS | Total by Tactic |
|----------------------|-----------|---------|---------|-------------------|
| Execution | 22 | 4 | 8 | 34 |
| Credential Access | 21 | 0 | 4 | 25 |
| Persistence | 15 | 0 | 2 | 17 |
| Discovery | 2 | 1 | 2 | 5 |
| Privilege Escalation | 33 | 2 | 2 | 37 |
| Defense Evasion | 42 | 0 | 3 | 45 |
| Impact | 10 | 1 | 1 | 12 |
| Initial Access | 22 | 0 | 0 | 22 |
| Lateral Movement | 5 | 0 | 1 | 6 |
| Command and Control | 8 | 0 | 1 | 9 |
| Total by OS | 180 | 8 | 24 | 212 |
### Licensing
These rules are licensed under the Elastic License v2. All rules have been designed to be used in the context of the Elastic Endpoint within the Elastic Security application.
behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml
+94
View File
@@ -0,0 +1,94 @@
[rule]
description = """
Identifies DNS queries to known Dynamic DNS Providers by a signed Microsoft binary execution proxy. Dynamic DNS
providers are often misused to host malware Command and Control servers.
"""
id = "fb6939a2-1b54-428c-92a2-3a831585af2a"
license = "Elastic License v2"
name = "Connection to Dynamic DNS Provider by a Signed Binary Proxy"
os_list = ["windows"]
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and user.id : "S-1-5-21-*" and
(
process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
"powershell.exe", "pwsh.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe",
"installutil.exe","RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe") or
process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
"?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
"?:\\Windows\\Microsoft.NET\\*.exe")
)
]
[dns where
dns.question.name :
(
"*.no-ip.com",
"*.no-ip.org",
"*.no-ip.biz",
"*.no-ip.info",
"*.noip.com",
"*.afraid.org",
"*.changeip.com",
"*.ddns.net",
"*.dyndns.org",
"*.hopto.org",
"*.zapto.org",
"*.servehttp.com",
"*.sytes.net",
"*.myftp.biz",
"*.myftp.org",
"*.ddnsfree.com",
"*.duckdns.org",
"*.000webhostapp.com",
"*.myddns.me",
"*.dlinkddns.com",
"*.chickenkiller.com",
"*.thddns.net",
"*.linkpc.net",
"*.gotdns.ch"
) and
/* covered by rule Id 51894221-7657-4b56-9406-e080e19ad159 */
not dns.question.name : "checkip.dyndns.org"
]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml
+75
View File
@@ -0,0 +1,75 @@
[rule]
description = """
Identifies DNS queries to known Dynamic DNS Providers by an unsigned program. Dynamic DNS providers are often misused to
host malware Command and Control servers.
"""
id = "75b80e66-90d0-4ab6-9e6b-976f7d690906"
license = "Elastic License v2"
name = "Connection to Dynamic DNS Provider by an Unsigned Binary"
os_list = ["windows"]
version = "1.0.6"
query = '''
sequence by process.entity_id with maxspan=1m
/* execution of an unsigned PEfollowed by dns request to dynamic dns provider */
[process where event.action == "start" and user.id : "S-1-5-21-*" and
not process.code_signature.trusted == true and
process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*")]
[dns where
dns.question.name :
(
"*.no-ip.com",
"*.no-ip.org",
"*.no-ip.biz",
"*.no-ip.info",
"*.noip.com",
"*.afraid.org",
"*.changeip.com",
"*.ddns.net",
"*.dyndns.org",
"*.hopto.org",
"*.zapto.org",
"*.servehttp.com",
"*.sytes.net",
"*.myftp.biz",
"*.myftp.org",
"*.ddnsfree.com",
"*.duckdns.org",
"*.000webhostapp.com",
"*.myddns.me",
"*.dlinkddns.com",
"*.chickenkiller.com",
"*.thddns.net",
"*.linkpc.net",
"*.gotdns.ch"
) and
/* covered by rule Id dfe28e03-9b0b-47f5-9753-65ed2666663f */
not dns.question.name : "checkip.dyndns.org"]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
+125
View File
@@ -0,0 +1,125 @@
[rule]
description = """
Identifies DNS queries to common web services by a signed Microsoft binary execution proxy. Adversaries may implement
command and control communications that use common web services in order to hide their activity.
"""
id = "c567240c-445b-4000-9612-b5531e21e050"
license = "Elastic License v2"
name = "Connection to WebService by a Signed Binary Proxy"
os_list = ["windows"]
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and user.id : "S-1-5-21-*" and
(
process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
"msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
"msxsl.exe", "xwizard.exe", "csc.exe") or
process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
"?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
"?:\\Windows\\Microsoft.NET\\*.exe") or
(process.name : ("powershell.exe", "pwsh.exe") and process.args_count >= 2)
) and
not (process.name : "rundll32.exe" and process.command_line : "*davclnt.dll,DavSetCookie*") and
not (process.parent.executable : ("?:\\Program Files\\Microsoft SQL Server\\MSSQL*.EXE", "?:\\Program Files\\WindowsApps\\Microsoft.*.exe") and
process.name : ("powershell.exe", "pwsh.exe")) and
not (process.name : "java.exe" and process.parent.executable : "?:\\Program Files\\OWASP\\Zed Attack Proxy\\ZAP.exe") and
not (process.name : "java.exe" and process.args_count >= 5)
]
[dns where
dns.question.name :
(
"raw.githubusercontent.*",
"pastebin.*",
"paste.ee",
"ghostbin.com",
"drive.google.com",
"?.docs.live.net",
"api.dropboxapi.*",
"content.dropboxapi.*",
"dl.dropboxusercontent.*",
"api.onedrive.com",
"*.onedrive.org",
"onedrive.live.com",
"filebin.net",
"?.tcp.ngrok.io",
"ngrok.com",
"*.portmap.*",
"*serveo.net",
"*localtunnel.me",
"*pagekite.me",
"*localxpose.io",
"*notabug.org",
"rawcdn.githack.*",
"paste.nrecom.net",
"zerobin.net",
"controlc.com",
"requestbin.net",
"slack.com",
"api.slack.com",
"slack-redir.net",
"slack-files.com",
"cdn.discordapp.com",
"discordapp.com",
"discord.com",
"apis.azureedge.net",
"cdn.sql.gg",
"api.*",
"?.top4top.io",
"top4top.io",
"www.uplooder.net",
"*.cdnmegafiles.com",
"transfer.sh",
"updates.peer2profit.com",
"api.telegram.org",
"meacz.gq",
"rwrd.org",
"*.publicvm.com",
"*.blogspot.com"
)
]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"
[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/command_and_control_connection_to_webservice_by_an_unsigned_binary.toml
+101
View File
@@ -0,0 +1,101 @@
[rule]
description = """
Identifies DNS queries to common web services by an unsigned program. Adversaries may implement command and control
communications that use common web services in order to hide their activity.
"""
id = "2c3efa34-fecd-4b3b-bdb6-30d547f2a1a4"
license = "Elastic License v2"
name = "Connection to WebService by an Unsigned Binary"
os_list = ["windows"]
version = "1.0.6"
query = '''
sequence by process.entity_id with maxspan=1m
/* execution of an unsigned PE file followed by dns lookup to commonly abused trusted webservices */
[process where event.action == "start" and user.id : "S-1-5-21-*" and
not process.code_signature.trusted == true and
process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*")]
[dns where
dns.question.name :
(
"raw.githubusercontent.*",
"pastebin.*",
"paste.ee",
"ghostbin.com",
"drive.google.com",
"d.docs.live.net",
"api.dropboxapi.*",
"content.dropboxapi.*",
"dl.dropboxusercontent.*",
"api.onedrive.com",
"*.onedrive.org",
"onedrive.live.com",
"filebin.net",
"?.tcp.ngrok.io",
"ngrok.com",
"*.portmap.*",
"*serveo.net",
"*localtunnel.me",
"*pagekite.me",
"*localxpose.io",
"*notabug.org",
"rawcdn.githack.*",
"paste.nrecom.net",
"zerobin.net",
"controlc.com",
"requestbin.net",
"slack.com",
"api.slack.com",
"slack-redir.net",
"slack-files.com",
"cdn.discordapp.com",
"discordapp.com",
"discord.com",
"cdn.sql.gg",
"cdn.discordapp.com",
"www.uplooder.net",
"*.cdnmegafiles.com",
"transfer.sh",
"updates.peer2profit.com",
"api.telegram.org",
"bing.com",
"yahoo.com",
"meacz.gq",
"rwrd.org",
"*.publicvm.com",
"*.blogspot.com"
)
]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"
[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/command_and_control_execution_of_a_file_written_by_a_signed_binary_proxy.toml
+60
View File
@@ -0,0 +1,60 @@
[rule]
description = """
Identifies the execution of a file written or modified by a signed Microsoft binary proxy utility such as MSHTA.exe,
CertReq.exe or CertUtil.exe. Adversaries may bypass process and/or signature-based defenses by proxying execution of
malicious content with signed binaries.
"""
id = "ccbc4a79-3bae-4623-aaef-e28a96bf538b"
license = "Elastic License v2"
name = "Execution of a File Written by a Signed Binary Proxy"
os_list = ["windows"]
version = "1.0.5"
query = '''
sequence with maxspan=5m
[file where event.action != "deletion" and
process.name : ("MSHTA.EXE", "CertUtil.exe", "CertReq.exe") and
not file.path : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")] by file.path
[process where event.action == "start" and
not process.parent.executable : ("?:\\Windows\\System32\\drvinst.exe") and
not (process.code_signature.subject_name: "Bentley Systems, Incorporated" and process.code_signature.trusted == true)
] by process.executable
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/command_and_control_netwire_rat_registry_modification.toml
+46
View File
@@ -0,0 +1,46 @@
[rule]
description = """
Identifies registry modification activity consistent with the NetWire Remote Access Trojan (RAT). NetWire is a publicly
available, multi-platform RAT that is used by criminal and APT groups.
"""
id = "102f340f-1839-4bad-8493-824cc02c4e69"
license = "Elastic License v2"
name = "NetWire RAT Registry Modification"
os_list = ["windows"]
reference = ["https://attack.mitre.org/software/S0198/", "https://any.run/malware-trends/netwire"]
version = "1.0.5"
query = '''
registry where
registry.path : (
"HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\NetWire\\HostId",
"HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\NetWire\\Install Date")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/command_and_control_remcos_rat_registry_or_file_modification.toml
+50
View File
@@ -0,0 +1,50 @@
[rule]
description = """
Identifies registry and file system activity consistent with the Remcos Remote Access Trojan (RAT). Remcos RAT is used
by attackers to perform actions on infected machines remotely.
"""
id = "9769d372-4115-4ef8-8d7b-aaad05dad9ae"
license = "Elastic License v2"
name = "Remcos RAT Registry or File Modification"
os_list = ["windows"]
reference = ["https://attack.mitre.org/software/S0332/", "https://any.run/malware-trends/remcos"]
version = "1.0.5"
query = '''
any where event.category : ("registry", "file") and
(
registry.path : (
"HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Remcos",
"HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Remcos-*\\licence",
"HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Remcos-*\\exepath") or
file.path : "?:\\Users\\*\\AppData\\Roaming\\remcos\\logs.dat"
)
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/command_and_control_shlayer_malware_infection.toml
+47
View File
@@ -0,0 +1,47 @@
[rule]
description = """
Identifies the execution of curl to download a payload for execution. This behavior is consistent with Shlayer malware.
Shlayer is a macOS malware family associated with ad fraud activity. Shlayer masquerades typically as an installer for
applications like Adobe Flash Player and executes numerous macOS commands to deobfuscate code and install adware with
persistence mechanisms.
"""
id = "3dda1ac2-86ef-41f5-ad3b-d9396383e104"
license = "Elastic License v2"
name = "Shlayer Malware Infection"
os_list = ["macos"]
reference = [
"https://attack.mitre.org/software/S0402/",
"https://redcanary.com/threat-detection-report/threats/shlayer/",
"https://securelist.com/shlayer-for-macos/95724/",
]
version = "1.0.5"
query = '''
process where event.action == "exec" and process.name == "curl" and process.args : "-f0L"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/command_and_control_suspicious_netsupport_execution.toml
+41
View File
@@ -0,0 +1,41 @@
[rule]
description = """
Identifies a suspicious execution of NetSupport remote access software from non-default paths, issuing a DNS query to a
non-standard NetSupport domain.
"""
id = "ad53a366-161a-4fa7-a75a-cc00658a767f"
license = "Elastic License v2"
name = "Suspicious NetSupport Execution"
os_list = ["windows"]
reference = ["https://www.netsupportsoftware.com/"]
version = "1.0.4"
query = '''
sequence by process.entity_id with maxspan=1m
[process where process.pe.original_file_name : "client32.exe" and
process.code_signature.subject_name : "NetSupport Ltd" and
not process.executable : ("?:\\Program Files\\NetSupport*.exe", "?:\\Program Files (x86)\\NetSupport*.exe") and
not process.parent.executable : ("?:\\Program Files\\NetSupport*.exe", "?:\\Program Files (x86)\\NetSupport*.exe")]
[dns where not dns.question.name : "*.netsupportsoftware.com"]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1219"
name = "Remote Access Software"
reference = "https://attack.mitre.org/techniques/T1219/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_credential_access_via_known_utilities.toml
+79
View File
@@ -0,0 +1,79 @@
[rule]
description = """
Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database
(NTDS.dit) in preparation for credential access.
"""
id = "3c44fc50-2672-48b3-af77-ff43b895ac70"
license = "Elastic License v2"
name = "Credential Access via Known Utilities"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/"]
version = "1.0.11"
query = '''
process where event.action == "start" and
process.parent.name != null and
(
(process.pe.original_file_name == "procdump" and process.args : "-ma") or
(process.name : "ProcessDump.exe" and not process.parent.executable : "?:\\Program Files*\\Cisco Systems\\*.exe") or
(process.pe.original_file_name == "WriteMiniDump.exe" and not process.parent.executable : "?:\\Program Files*\\Steam\\*.exe") or
/* Issue #623 - added coverage for evasion via renamed comsvcs DLL */
(process.pe.original_file_name == "RUNDLL32.EXE" and process.command_line : ("*comsvcs*#24*", "*MiniDump*", "*#24 * full*")) or
(process.pe.original_file_name == "RdrLeakDiag.exe" and process.args : "/fullmemdmp") or
(process.pe.original_file_name == "SqlDumper.exe" and process.args : "0x01100*") or
(process.pe.original_file_name == "TTTracer.exe" and process.args : "-dumpFull" and process.args : "-attach") or
(process.pe.original_file_name == "ntdsutil.exe" and process.command_line : "*create*") or
(process.pe.original_file_name == "diskshadow.exe" and process.args : "/s") or
(process.pe.original_file_name == "esentutl.exe" and process.args : "/vss" and process.command_line : ("*ntds.dit*", "*\\SAM*", "*//SAM*")) or
(process.pe.original_file_name == "reg.exe" and process.args : ("save", "export") and
process.command_line : ("*HKLM*\\SAM *", "*hkey_local_machine*\\SAM *", "*HKLM\\security*",
"*hkey_local_machine\\security*", "*HKLM\\system *", "*hkey_local_machine\\system *")) or
/* generic original filename and variable number of hashes */
(process.name : "createdump.exe" and process.args : "-u") or
(process.pe.original_file_name == "FX_VER_INTERNALNAME_STR" and process.args : "-u" and process.args : "-f" and process.args_count >= 3) or
/* taskmgr via GUI - Create dump file - excluding Explorer to avoid breaking legit use of taskmgr */
(process.pe.original_file_name == "Taskmgr.exe" and process.args == "/4" and not process.parent.executable : "?:\\Windows\\explorer.exe") or
/* Avast Home Security signed binary */
(process.pe.original_file_name == "avDump.exe" and process.args : "–dump_file")
) and not
/* Issue #528 */
(process.pe.original_file_name == "reg.exe" and
process.parent.executable : ("?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe",
"?:\\Program Files (x86)\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe")) and not
(process.pe.original_file_name == "diskshadow.exe" and process.parent.name : "powershell.exe" and process.parent.args : "?:\\OmniStackBackups\\backup*") and
not (process.name : "rundll32.exe" and
process.command_line : "*davclnt.dll,DavSetCookie*http*MiniDump*" and
process.parent.executable : "?:\\WINDOWS\\system32\\svchost.exe" and process.parent.args : "WebClient")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"
[[threat.technique.subtechnique]]
id = "T1003.003"
name = "NTDS"
reference = "https://attack.mitre.org/techniques/T1003/003/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_dumping_account_hashes_via_built_in_commands.toml
+41
View File
@@ -0,0 +1,41 @@
[rule]
description = """
Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump
credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for
lateral movement.
"""
id = "2ed766db-e0b0-4a07-8ec1-4e41dd406b64"
license = "Elastic License v2"
name = "Dumping Account Hashes via Built-In Commands"
os_list = ["macos"]
reference = [
"https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored",
"https://www.unix.com/man-page/osx/8/mkpassdb/",
]
version = "1.0.5"
query = '''
process where event.type == "start" and
process.name : ("defaults", "mkpassdb") and process.args : ("ShadowHashData", "-dump")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_lsa_dump_via_silentprocessexit.toml
+43
View File
@@ -0,0 +1,43 @@
[rule]
description = """
Identifies the modification of the Image File Execution Options SilentProcessExit key that can be abused to dump LSASS
memory via the Windows Error Reporting WerFault.exe. Adversaries may use this technique for credential access.
"""
id = "28969fe6-0ebe-4442-b40c-dbe9b4234f5e"
license = "Elastic License v2"
name = "LSA Dump via SilentProcessExit"
os_list = ["windows"]
reference = [
"https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/",
]
version = "1.0.8"
query = '''
registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass*"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_potential_access_to_kerberos_cached_credentials.toml
+42
View File
@@ -0,0 +1,42 @@
[rule]
description = "Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets."
id = "dc8fa849-efb4-45d1-be1a-9472325ff746"
license = "Elastic License v2"
name = "Potential Access to Kerberos Cached Credentials"
os_list = ["macos"]
reference = [
"https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py",
"https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html",
]
version = "1.0.4"
query = '''
process where event.type == "start" and
process.name : "kcc" and process.command_line : "*copy_cred_cache*"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"
[[threat.technique.subtechnique]]
id = "T1558.003"
name = "Kerberoasting"
reference = "https://attack.mitre.org/techniques/T1558/003/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_potential_credential_access_via_mimikatz.toml
+67
View File
@@ -0,0 +1,67 @@
[rule]
description = """
Identifies the usage of Mimikatz using known malicious command line arguments. Mimikatz is a credential dumper capable
of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for
testing the security of networks.
"""
id = "86bf5d50-7f5d-44b4-977b-dff222379727"
license = "Elastic License v2"
name = "Potential Credential Access via Mimikatz"
os_list = ["windows"]
reference = ["https://adsecurity.org/?page_id=1821", "https://github.com/gentilkiwi/mimikatz"]
version = "1.0.4"
query = '''
process where event.action == "start" and
process.args : (
"privilege::debug",
"sekurlsa::logonpasswords",
"sekurlsa::pth",
"lsadump::sam",
"lsadump::dcsync",
"vault::cred",
"vault::list",
"token::elevate",
"/user:krbtgt",
"kerberos::tgt",
"kerberos::ptt",
"kerberos::list",
"misc::memssp"
)
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"
[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_potential_credential_access_via_rubeus.toml
+62
View File
@@ -0,0 +1,62 @@
[rule]
description = """
Identifies the usage of Rubeus using known malicious command line arguments. Rubeus is a toolset used for a diverse set
of Kerberos Abuses and Manipulations like renew, ask, extract, and forge Kerberos Tickets.
"""
id = "0783f666-75ad-4015-9dd5-d39baec8f6b0"
license = "Elastic License v2"
name = "Potential Credential Access via Rubeus"
os_list = ["windows"]
reference = [
"https://github.com/GhostPack/Rubeus",
"https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_rubeus.yml",
]
version = "1.0.5"
query = '''
process where event.action == "start" and
process.command_line : (
"* asreproast *",
"* dump /service:krbtgt*",
"* dump /luid:*",
"* kerberoast *",
"* createnetonly /program:*",
"* ptt /ticket:*",
"* /impersonateuser:*",
"* renew /ticket:*",
"* asktgt /user:*",
"* asktgs /ticket:*",
"* harvest /interval:*",
"* s4u /user:*",
"* s4u /ticket:*",
"* hash /password:*",
"* tgtdeleg",
"* tgtdeleg /target:*",
"* golden /des:*",
"* golden /rc4:*",
"* golden /aes128:*",
"* golden /aes256:*",
"* changpw /ticket:*"
)
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1558"
name = "Steal or Forge Kerberos Tickets"
reference = "https://attack.mitre.org/techniques/T1558/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_potential_credential_access_via_windows_credential_history.toml
+55
View File
@@ -0,0 +1,55 @@
[rule]
description = """
Identifies an unusual process accessing Users Windows Credential History File. The CREDHIST file contains previous
password related master key hashes used by Microsoft's DPAPI. Adversaries may acquire credentials from the Windows
Credential Manager.
"""
id = "ce8a6302-7248-457a-8427-3d6bad14e2f0"
license = "Elastic License v2"
name = "Potential Credential Access via Windows Credential History"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.4"
query = '''
file where event.action == "open" and
/* Credentials History */
file.path : "?:\\Users\\*\\AppData\\*\\Microsoft\\Protect\\CREDHIST" and
user.id : "S-1-5-21*" and process.executable : "?:\\*" and
/* third party programs and noisy native system processes */
not process.executable :
("?:\\Program Files\\*",
"?:\\Program Files (x86)\\*",
"?:\\Windows\\System32\\lsass.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\Robocopy.exe",
"?:\\Windows\\ccmcache\\*.exe",
"?:\\Windows\\CCM\\*.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_potential_credentials_phishing_via_osascript.toml
+47
View File
@@ -0,0 +1,47 @@
[rule]
description = """
Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for
credentials.
"""
id = "318d3d9d-ba60-40e3-bc8c-3d3304209a3c"
license = "Elastic License v2"
name = "Potential Credentials Phishing via OSASCRIPT"
os_list = ["macos"]
reference = [
"https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/prompt.py",
"https://ss64.com/osx/osascript.html",
]
version = "1.0.5"
query = '''
process where event.action == "exec" and
process.name : "osascript" and process.command_line : "*osascript*display*dialog*password*" and
not (process.parent.executable : "/usr/bin/sudo" and process.command_line : "*Encryption Key Escrow*") and
not (process.command_line : "*-e with timeout of 3600 seconds*" and user.id == 0 and process.parent.executable : "/bin/bash")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.002"
name = "GUI Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/002/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_potential_discovery_of_dpapi_master_keys.toml
+68
View File
@@ -0,0 +1,68 @@
[rule]
description = """
Identifies an unusual process accessing Data Protection API Master keys. Adversaries may attempt to discover and acquire
credentials from the Windows Credential Manager.
"""
id = "84bbe951-5141-4eb3-b9cf-8dfeea62a94e"
license = "Elastic License v2"
name = "Potential Discovery of DPAPI Master Keys"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.7"
query = '''
file where event.action == "open" and
file.path : ("?:\\USERS\\*\\APPDATA\\*\\MICROSOFT\\PROTECT\\S-1-5-21*\\*",
"?:\\WINDOWS\\SYSTEM32\\MICROSOFT\\PROTECT\\S-1-5-18\\USER\\*") and
process.executable != null and
user.id : "S-1-5-21-*" and
not process.executable :
("?:\\Program Files\\*",
"?:\\Program Files (x86)\\*",
"?:\\Windows\\System32\\lsass.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\Robocopy.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
"System",
"?:\\Windows\\ccmcache\\*.exe",
"?:\\WINDOWS\\CCM\\*.exe",
"?:\\Windows\\SysWOW64\\prevhost.exe",
"?:\\Windows\\System32\\prevhost.exe",
"?:\\Veritas\\NetBackup\\bin\\bpbkar32.exe",
"?:\\Windows\\System32\\taskhostw.exe",
"?:\\Windows\\System32\\taskhost.exe",
"?:\\Windows\\System32\\sdiagnhost.exe",
"?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"?:\\$WINDOWS.~BT\\Sources\\setuphost.exe",
"?:\\Windows\\explorer.exe",
"?:\\Windows\\System32\\sppsvc.exe",
"?:\\Windows\\System32\\backgroundTaskHost.exe") and
/* MSSQL service account */
not (process.name : "sqlservr.exe" and file.path : "?:\\Users\\svc_*")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.16.0"
behavior/rules/credential_access_potential_discovery_of_windows_credential_manager_store.toml
+68
View File
@@ -0,0 +1,68 @@
[rule]
description = """
Identifies an unusual process accessing User or System Windows Credential Manager Files. Adversaries may attempt to list
and acquire credentials from the Windows Credential Manager.
"""
id = "cc60be0e-2c6c-4dc9-9902-e97103ff8df9"
license = "Elastic License v2"
name = "Potential Discovery of Windows Credential Manager Store"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.6"
query = '''
file where event.action == "open" and
file.path : ("?:\\Users\\*\\AppData\\*\\Microsoft\\Credentials\\*",
"?:\\Windows\\System32\\config\\systemprofile\\AppData\\*\\Microsoft\\Credentials\\*") and
process.executable != null and
user.id : "S-1-5-21-*" and
not process.executable :
("?:\\Program Files\\*",
"?:\\Program Files (x86)\\*",
"?:\\Windows\\System32\\lsass.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\Robocopy.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*.exe",
"?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
"?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\*.exe",
"System",
"?:\\Windows\\ccmcache\\*.exe",
"?:\\WINDOWS\\CCM\\*.exe",
"?:\\Windows\\SysWOW64\\prevhost.exe",
"?:\\Windows\\System32\\prevhost.exe",
"?:\\Veritas\\NetBackup\\bin\\bpbkar32.exe",
"?:\\Windows\\System32\\taskhostw.exe",
"?:\\Windows\\System32\\taskhost.exe",
"?:\\Windows\\System32\\sdiagnhost.exe",
"?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"?:\\Windows\\System32\\dllhost.exe",
"?:\\Windows\\explorer.exe",
"?:\\Windows\\System32\\MRT.exe")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.16.0"
behavior/rules/credential_access_security_account_manager_(sam)_file_access.toml
+69
View File
@@ -0,0 +1,69 @@
[rule]
description = """
Identifies access to the Security Account Manager (SAM) database file, which adversaries can use to recover password
hashes for local accounts.
"""
id = "dc27190a-688b-4f9b-88f0-1f13deccd67f"
license = "Elastic License v2"
name = "Security Account Manager (SAM) File Access"
os_list = ["windows"]
reference = [
"https://adsecurity.org/?page_id=1821",
"https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
]
version = "1.0.8"
query = '''
file where event.action == "open" and
file.path :
("?:\\WINDOWS\\SYSTEM32\\CONFIG\\SAM",
"\\??\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\WINDOWS\\SYSTEM32\\CONFIG\\SAM",
"\\Device\\HarddiskVolume*\\WINDOWS\\SYSTEM32\\CONFIG\\SAM") and
user.id != null and process.executable : "?:\\*" and not process.pid == 4 and
not process.executable :
("?:\\Windows\\System32\\svchost.exe",
"?:\\Program Files (x86)\\*",
"?:\\Program Files\\*",
"?:\\Windows\\System32\\wuauclt.exe",
"?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
"?:\\Windows\\System32\\vmwp.exe",
"?:\\Windows\\System32\\Dism.exe",
"?:\\Windows\\System32\\wbengine.exe",
"?:\\Windows\\System32\\mmc.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
"?:\\Windows\\System32\\sppsvc.exe",
"?:\\Windows\\System32\\backgroundTaskHost.exe",
"?:\\Windows\\System32\\lsass.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*.exe",
"?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
"?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\*.exe") and
/* mounted OS install */
not file.path : "?:\\?*\\Windows\\System32\\*"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_security_account_manager_(sam)_registry_access.toml
+68
View File
@@ -0,0 +1,68 @@
[rule]
description = """
Identifies attempts to read the Security Account Manager database through the registry, which adversaries can use to
recover password hashes for local accounts.
"""
id = "b6e8c090-f0ec-4c4c-af00-55ac2a9f9b41"
license = "Elastic License v2"
name = "Security Account Manager (SAM) Registry Access"
os_list = ["windows"]
reference = [
"https://adsecurity.org/?page_id=1821",
"https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
]
version = "1.0.6"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
not (process.name : "cscript.exe" and process.command_line : "*Tanium*collectAdInfo.vbs*" and
process.Ext.token.integrity_level_name == "system") and
not (process.code_signature.subject_name : ("Check Point Software Technologies Ltd.", "AO Kaspersky Lab") and process.code_signature.trusted == true) and
not (process.executable : "?:\\Windows\\Provisioning\\Autopilot\\DiagonsticAnalysis.pif" and
process.args : "?:\\Windows\\Provisioning\\Microsoft-Desktop-Provisioning-Diagnostic.dat") and
not (process.parent.executable : "?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe" and process.name : "reg.exe") and
not (process.executable : "?:\\Windows\\System32\\backgroundTaskHost.exe" and
process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.parent.args : "DcomLaunch" and
process.args : "-ServerName:BackgroundTaskHost.WebAccountProvider")
]
[registry where event.action == "query" and
registry.path : "HKLM\\SAM\\SAM\\Domains\\Account\\*" and
/*
encrypted password LM/NT bytes are stored in V regval
under Account\Users key, to reduce noise we exclude following exact reg paths
*/
not registry.path : ("HKLM\\SAM\\SAM\\Domains\\Account\\Users",
"HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names",
"HKLM\\SAM\\SAM\\Domains\\Account",
"HKLM\\SAM\\SAM\\Domains\\Account\\Aliases\\*")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_sensitive_file_access_cloud_credentials.toml
+73
View File
@@ -0,0 +1,73 @@
[rule]
description = """
Identifies an unusual process accessing common cloud providers credential files. Adversaries may search local file
systems and remote file shares for files containing insecurely stored credentials.
"""
id = "39f60a36-8c5a-4703-8576-ad3e8c800a0f"
license = "Elastic License v2"
name = "Sensitive File Access - Cloud Credentials"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt"]
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
user.id : "S-1-5-21*" and process.executable != null and
not process.executable :
(
/* third party programs common install path - requires local admin */
"?:\\Program Files\\*",
"?:\\Program Files (x86)\\*",
/*
dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
explorer.exe for directory and file discovery.
SearchProtocolHost.exe is for file searches and indexing.
*/
"?:\\Windows\\explorer.exe",
"?:\\Windows\\System32\\dllhost.exe",
"?:\\Windows\\System32\\SearchProtocolHost.exe",
/* Windows Defender */
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe")]
[file where event.type == "access" and
/* non system accounts */
user.id : "S-1-5-21*" and
/* AWS/Google/Azure/Git cloud credential files */
file.path : ("?:\\users\\*\\AppData\\*\\gcloud\\credentials.db",
"?:\\users\\*\\AppData\\*\\gcloud\\legacy_credentials",
"?:\\users\\*\\AppData\\*\\gcloud\\access_tokens.db",
"?:\\users\\*\\.azure\\accessTokens.json",
"?:\\users\\*\\.azure\\azureProfile.json",
"?:\\users\\*\\.aws\\credentials",
"?:\\Users\\*\\.config\\git\\credentials")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_sensitive_file_access_remote_desktop_connection_manager.toml
+66
View File
@@ -0,0 +1,66 @@
[rule]
description = """
Identifies an unusual process accessing Remote Desktop Connection Manager settings file. Adversaries may search and
steal credentials from administration utilities configuration files.
"""
id = "934232e5-66d3-4e80-a4ee-a9f1b7d2a7bc"
license = "Elastic License v2"
name = "Sensitive File Access - Remote Desktop Connection Manager"
os_list = ["windows"]
reference = [
"http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/",
"https://smsagent.blog/2017/01/26/decrypting-remote-desktop-connection-manager-passwords-with-powershell/",
]
version = "1.0.6"
query = '''
file where event.type == "access" and
/* domain user RID */
user.id : "S-1-5-21*" and
file.path : "?:\\Users\\*\\AppData\\Local\\*\\Remote Desktop Connection Manager\\RDCMan.settings" and
not process.executable : "?:\\Program Files (x86)\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.exe" and
not (process.name : "RDCMan.exe" and process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.001"
name = "Remote Desktop Protocol"
reference = "https://attack.mitre.org/techniques/T1021/001/"
[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[internal]
min_endpoint_version = "8.0.0"
behavior/rules/credential_access_sensitive_file_access_ssh_saved_keys.toml
+85
View File
@@ -0,0 +1,85 @@
[rule]
description = """
Identifies an unusual process accessing common SSH clients saved SSH keys. Adversaries may search local file systems and
remote file shares for files containing insecurely stored credentials.
"""
id = "1487d726-2bd2-4a9e-a9d2-db8aef1d6239"
license = "Elastic License v2"
name = "Sensitive File Access - SSH Saved Keys"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
version = "1.0.7"
query = '''
any where event.category in ("registry", "file") and
event.action in ("query", "open") and
user.id : "S-1-5-21*" and process.executable : "?:\\*" and
(file.path : "?:\\Users\\*\\.ssh\\known_hosts" or
registry.path : "HKEY_USERS\\S-1-5-21*\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\*") and
not process.executable :
("?:\\Program Files\\*",
"?:\\Program Files (x86)\\*",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe",
"?:\\Windows\\System32\\OpenSSH\\*.exe",
"?:\\Windows\\System32\\smartscreen.exe",
"?:\\WINDOWS\\system32\\reg.exe",
"?:\\Windows\\regedit.exe",
"?:\\Windows\\System32\\notepad.exe",
"?:\\Windows\\System32\\Robocopy.exe",
"?:\\Windows\\System32\\cmd.exe",
"?:\\Windows\\explorer.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\$WINDOWS.~BT\\Sources\\setuphost.exe",
"?:\\Users\\*\\AppData\\Local\\Programs\\Git\\mingw64\\bin\\git.exe",
"?:\\Users\\*\\AppData\\Local\\DBeaver\\dbeaver.exe") and
/* many of the following exclusions are not signed nor have an original file name */
not process.name : ("pscp.exe", "psftp.exe", "_ssh.exe", "plink.exe", "PuTTYNG.exe", "putty*.exe", "busybox.exe",
"ssh.exe", "WinSCP.exe", "bash.exe", "MoTTY.exe", "eclipse.exe", "code.exe", "datagrip*.exe",
"MobaXterm_Personal*.exe", "RoyalTS_PuTTY*.exe", "MAP.EXE", "rssputty.exe", "phpstorm64.exe",
"Fork.exe", "fzsftp.exe")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.004"
name = "SSH"
reference = "https://attack.mitre.org/techniques/T1021/004/"
[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_sensitive_file_access_system_admin_utilities.toml
+90
View File
@@ -0,0 +1,90 @@
[rule]
description = """
Identifies an unusual process accessing common third party system utilities sensitive files and registries. Adversaries
may search local file systems and remote file shares for files containing insecurely stored credentials.
"""
id = "949c72ee-a283-4673-afe0-7fa72bddc2f6"
license = "Elastic License v2"
name = "Sensitive File Access - System Admin Utilities"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
version = "1.0.6"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
user.id : "S-1-5-21*" and process.executable : "?:\\*" and
not process.executable :
(
/* third party programs common install path - requires local admin */
"?:\\Program Files\\*",
"?:\\Program Files (x86)\\*",
/*
dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
explorer.exe for directory and file discovery.
SearchProtocolHost.exe is for file searches and indexing.
*/
"?:\\Windows\\explorer.exe",
"?:\\Windows\\System32\\dllhost.exe",
"?:\\Windows\\System32\\SearchProtocolHost.exe",
"?:\\Windows\\regedit.exe",
"?:\\Windows\\system32\\reg.exe",
"?:\\Windows\\System32\\notepad.exe",
"?:\\Windows\\System32\\Robocopy.exe",
"?:\\Windows\\System32\\cmd.exe",
/* Windows Defender */
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe",
/* lot of legit access from mounted sysadmin file shares */
"\\Device\\Mup\\*.exe") and
not (process.code_signature.subject_name :
("Martin Prikryl",
"OpenVPN Technologies, Inc.",
"TeamViewer Germany GmbH",
"Open Source Developer, Dominik Reichl",
"Tim Kosse",
"TEFINCOM S.A.",
"nordvpn s.a.") and
process.code_signature.trusted == true)
]
[any where event.category in ("registry", "file") and
event.action in ("query", "open") and
(
file.path : ("?:\\Users\\*\\AppData\\Roaming\\KeePass\\KeePass.config.xml",
"?:\\Users\\*\\AppData\\*\\NordVPN\\NordVPN.exe*\\user.config",
"?:\\Users\\*\\AppData\\*\\FileZilla\\recentservers.xml",
"?:\\Users\\*\\AppData\\*\\FileZilla\\sitemanager.xml") or
registry.path : ("HKEY_USERS\\S-1-5-21*\\software\\Martin Prikryl\\WinSCP *\\Sessions\\*\\Password*",
"HKEY_USERS\\S-1-5-21*\\SOFTWARE\\WOW6432Node\\TeamViewer\\ProxyPassword",
"HKEY_USERS\\S-1-5-21*\\Software\\OpenVPN-GUI\\Configs\\*auth-data*")
) and
/* unsigned KeePass */
not (process.name : "KeePass.exe" and file.name : "KeePass.config.xml")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_sensitive_file_access_unattended_panther.toml
+81
View File
@@ -0,0 +1,81 @@
[rule]
description = """
Identifies an unusual process accessing Windows Panther Installation files. Adversaries may search local file systems
and remote file shares for files containing insecurely stored credentials.
"""
id = "52e4ad92-e09b-4331-b827-cd0f2cbaf576"
license = "Elastic License v2"
name = "Sensitive File Access - Unattended Panther"
os_list = ["windows"]
reference = [
"https://steflan-security.com/windows-privilege-escalation-credential-harvesting/",
"https://github.com/pha5matis/Pentesting-Guide/blob/master/privilege_escalation_windows.md",
]
version = "1.0.6"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
user.id : "S-1-5-21*" and process.executable != null and
not process.executable :
(
/* third party programs common install path - requires local admin */
"?:\\Program Files\\*",
"?:\\Program Files (x86)\\*",
/*
dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
explorer.exe for directory and file discovery.
SearchProtocolHost.exe is for file searches and indexing.
*/
"?:\\Windows\\explorer.exe",
"?:\\Windows\\System32\\dllhost.exe",
"?:\\Windows\\System32\\SearchProtocolHost.exe",
/* Windows Defender */
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
"?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\*.exe",
"?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
"?:\\Windows\\System32\\notepad.exe",
"?:\\Windows\\System32\\Robocopy.exe",
"?:\\Windows\\System32\\cmd.exe",
"?:\\Windows\\System32\\xcopy.exe",
"?:\\Windows\\System32\\SystemSettingsAdminFlows.exe",
"?:\\Windows\\System32\\smartscreen.exe")]
[file where event.type == "access" and
/* non system accounts */
user.id : "S-1-5-21*" and
file.path : ("?:\\Windows\\Panther\\Unattend.xml",
"?:\\Windows\\Panther\\Unattended.xml",
"?:\\Windows\\Panther\\Unattend\\Unattended.xml",
"?:\\Windows\\Panther\\Unattend\\Unattend.xml",
"?:\\Windows\\System32\\Sysprep\\unattend.xml",
"?:\\Windows\\System32\\Sysprep\\Panther\\unattend.xml")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_suspicious_access_to_active_directory_database_file.toml
+62
View File
@@ -0,0 +1,62 @@
[rule]
description = """
Identifies access to the Active Directory Domain Database file (ntds.dit). This file contains sensitive information
including hashed domain credentials.
"""
id = "d66765b8-010b-4a40-ab62-1d8f13a44878"
license = "Elastic License v2"
name = "Suspicious Access to Active Directory Database File"
os_list = ["windows"]
reference = [
"https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration",
]
version = "1.0.7"
query = '''
file where event.action == "open" and process.pid != 4 and
file.path : "*\\Windows\\NTDS\\ntds.dit" and process.executable : "?:\\*" and
/* covered by RuleId 3c44fc50-2672-48b3-af77-ff43b895ac70 */
not process.executable :
("?:\\Windows\\System32\\ntdsutil.exe",
"?:\\Windows\\System32\\esentutl.exe",
"?:\\Windows\\system32\\lsass.exe",
"?:\\Windows\\System32\\wbengine.exe",
"?:\\Program Files\\Bitdefender\\Endpoint Security\\epsecurityservice.exe",
"?:\\Program Files\\Common Files\\McAfee\\SystemCore\\mcshield.exe",
"?:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe",
"?:\\Program Files (x86)\\VIPRE Business Agent\\SBAMSvc.exe",
"?:\\Program Files\\Seqrite\\Seqrite\\SCANNER.EXE",
"?:\\Program Files\\Seqrite\\Seqrite Endpoint Security\\SCANNER.EXE",
"?:\\Program Files\\Seqrite\\Seqrite\\sapissvc.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*.exe",
"?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
"?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\*.exe",
"?:\\Program Files (x86)\\Sophos\\Sophos Anti-Virus\\SavService.exe")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.003"
name = "NTDS"
reference = "https://attack.mitre.org/techniques/T1003/003/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_suspicious_access_to_lsa_secrets_registry.toml
+63
View File
@@ -0,0 +1,63 @@
[rule]
description = """
Identifies access to the LSA Secrets policy registry hive by an unusual process. Adversaries with SYSTEM access to a
host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential
materials, such as credentials for service accounts.
"""
id = "c5ee8453-bc89-42e7-a414-1ba4bec85119"
license = "Elastic License v2"
name = "Suspicious Access to LSA Secrets Registry"
os_list = ["windows"]
reference = [
"https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets",
"https://github.com/gtworek/PSBits/tree/master/LSASecretDumper",
]
version = "1.0.6"
query = '''
registry where
registry.path : ("HKLM\\SECURITY\\Policy\\Secrets\\*", "HKLM\\SECURITY\\CACHE*") and process.executable != null and
user.id : "S-1-5-18" and
not process.executable : ("?:\\Windows\\System32\\lsass.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\lsass.exe",
"\\Device\\HarddiskVolume??\\Windows\\System32\\lsass.exe",
"?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\ToolsIQ.exe",
"?:\\Program Files\\Citrix\\PvsVm\\Service\\PvsVmAgent.exe",
"?:\\Windows\\Provisioning\\Autopilot\\DiagonsticAnalysis.pif",
"?:\\Program Files\\RepairTech\\LiveAgent\\SyncroLive.Agent.Runner.exe") and
not (process.executable : "?:\\Windows\\System32\\dsregcmd.exe" and registry.path : "HKLM\\SECURITY\\Policy\\Secrets\\DSREGCMD\\MutexName") and
not (process.executable : "?:\\Windows\\LTSvc\\LTSVC.exe" and registry.path : "HKLM\\SECURITY\\Cache\\NL$1") and
not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and
registry.path : "HKLM\\SECURITY\\Policy\\Secrets\\$MACHINE.ACC\\CupdTime\\")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.004"
name = "LSA Secrets"
reference = "https://attack.mitre.org/techniques/T1003/004/"
[[threat.technique.subtechnique]]
id = "T1003.005"
name = "Cached Domain Credentials"
reference = "https://attack.mitre.org/techniques/T1003/005/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_suspicious_access_to_web_browser_credential_stores.toml
+65
View File
@@ -0,0 +1,65 @@
[rule]
description = """
Identifies access to more than one web browser's credential store data by the same process. Adversaries may steal
credentials from web browsers by reading files specific to the target browser.
"""
id = "03758167-3eed-465f-9174-b284d599036d"
license = "Elastic License v2"
name = "Suspicious Access to Web Browser Credential Stores"
os_list = ["windows"]
version = "1.0.9"
query = '''
sequence by process.entity_id with maxspan=1m
[file where event.action == "open" and
user.id : "S-1-5-21*" and not process.pid == 4 and process.code_signature.trusted != true and
file.path :
( /* chromium based browsers (chrome, edge, brave etc.) */
"?:\\Users\\*\\AppData\\Local\\*\\User Data\\Default\\Login Data",
/* some infostealers access only the cookies file and don't touch pwd file logins.json */
"?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\logins.json",
"?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\cookies.sqlite") and
not process.executable :
("?:\\Program Files\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
"?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
"*\\Program Files*\\Windows Defender\\MsMpEng.exe")]
[file where event.action == "open" and
file.path :
("?:\\Users\\*\\AppData\\Local\\*\\User Data\\Default\\Login Data",
"?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\logins.json",
"?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\cookies.sqlite")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.0.0"
behavior/rules/credential_access_suspicious_access_to_windows_vault_files.toml
+56
View File
@@ -0,0 +1,56 @@
[rule]
description = """
Identifies an unusual process accessing Windows Vault files. Credential Lockers store credentials in encrypted .vcrd
files and the encryption key can be found in a file named Policy.vpol. Adversaries may acquire credentials from Vault
files.
"""
id = "831c1cda-8d8c-4c21-a84e-c428469e7d93"
license = "Elastic License v2"
name = "Suspicious Access to Windows Vault Files"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.4"
query = '''
file where event.action == "open" and
/* Credentials History */
(file.path : ("?:\\Users\\*\\AppData\\*\\Microsoft\\Vault\\*\\*", "?:\\ProgramData\\Microsoft\\Vault\\*") and
file.extension : ("vpol", "vcrd")) and
user.id : "S-1-5-21*" and process.executable : "?:\\*" and
/* third party programs and noisy native system processes */
not process.executable :
("?:\\Program Files\\*",
"?:\\Program Files (x86)\\*",
"?:\\Windows\\System32\\lsass.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\Robocopy.exe",
"?:\\Windows\\ccmcache\\*.exe",
"?:\\Windows\\CCM\\*.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_system_bootkey_registry_access.toml
+66
View File
@@ -0,0 +1,66 @@
[rule]
description = """
Identifies attempts to read the registry values used to calculate the System BootKey, which adversaries can use to
recover passwords and other secrets from the registry.
"""
id = "ae7812a1-1329-47b4-9d76-8c7359cda4e4"
license = "Elastic License v2"
name = "System BootKey Registry Access"
os_list = ["windows"]
reference = [
"http://moyix.blogspot.com/2008/02/syskey-and-sam.html",
"https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
]
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=1m
[registry where event.action == "query" and
/* Bootkey/Syskey - GBG, JD, Skew1 */
registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Skew1*",
"HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JD*",
"HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JDLSA\\GBG*") and
not (process.executable : ("?:\\Windows\\System32\\lsass.exe", "?:\\Windows\\System32\\svchost.exe") and
user.id in ("S-1-5-18", "S-1-5-19"))
]
[registry where event.action == "query" and
registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Skew1*",
"HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JD*",
"HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JDLSA\\GBG*")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"
[[threat.technique.subtechnique]]
id = "T1003.004"
name = "LSA Secrets"
reference = "https://attack.mitre.org/techniques/T1003/004/"
[[threat.technique.subtechnique]]
id = "T1003.005"
name = "Cached Domain Credentials"
reference = "https://attack.mitre.org/techniques/T1003/005/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_web_browser_credential_access_via_unsigned_process.toml
+55
View File
@@ -0,0 +1,55 @@
[rule]
description = """
Identifies an unsigned process accessing the password store of commonly used web browsers. Adversaries may steal
credentials from web browsers by reading files specific to the target browser.
"""
id = "9ed4ee4a-bc91-4d38-b6dd-11467b774460"
license = "Elastic License v2"
name = "Web Browser Credential Access via Unsigned Process"
os_list = ["windows"]
version = "1.0.7"
query = '''
sequence by user.name with maxspan=2m
/* PE file creation followed by its execution followed by browser credential stores access */
[file where event.action != "deletion" and
(file.Ext.header_bytes : "4d5a*" or file.extension : ("exe", "scr", "pif", "com"))] by file.path
[file where event.type == "access" and
/* domain user RID */
user.id : "S-1-5-21*" and
not process.code_signature.trusted == true and
not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
file.name : ("Login Data", "logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite")] by process.executable
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.0.0"
behavior/rules/credential_access_web_browser_credential_access_via_unusual_process.toml
+87
View File
@@ -0,0 +1,87 @@
[rule]
description = """
Identifies an unexpected process accessing the password store of commonly used web browsers. Adversaries may steal
credentials from web browsers by reading files specific to the target browser.
"""
id = "f488cd1b-2407-4ec8-8705-7adf99ccbd33"
license = "Elastic License v2"
name = "Web Browser Credential Access via Unusual Process"
os_list = ["windows"]
version = "1.0.5"
query = '''
file where event.type == "access" and
process.executable != null and
file.name : ("Login Data", "logins.json", "signons.sqlite", "cookies.sqlite") and
file.path : ("?:\\Users\\*", "\\??\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\Users\\*") and not
/* browsers have variable install path %programfiles% and Users home folder */
process.name : ("chrome.exe", "firefox.exe", "firefoxportable.exe", "brave.exe", "browser.exe", "dragon.exe", "iexplore.exe",
"msedge.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgecp.exe", "microsoftedgesh.exe", "opera.exe",
"vivaldi.exe", "palemoon.exe", "seamonkey.exe", "safari.exe", "waterfox.exe", "OneDrive.exe", "BCompare.exe",
"thunderbird.exe", "certutil.exe", "chromium.exe", "UpdateBrowserForApp.exe", "MsMpEng.exe", "MpCopyAccelerator.exe",
"CCleaner64.exe", "ESETOnlineScanner.exe", "detecttvsu.exe") and not
process.executable :
(
/* third party programs common install path - requires local admin */
"*\\Program Files\\*",
"*\\Program Files (x86)\\*",
/*
dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
explorer.exe for directory and file discovery.
SearchProtocolHost.exe is for file searches and indexing.
browserexport is a legit utility that can be used to migrate browser data (but not decrypt pwd).
*/
"*\\Windows\\explorer.exe",
"*\\Windows\\System32\\dllhost.exe",
"*\\Windows\\System32\\Robocopy.exe",
"*\\Windows\\System32\\browserexport.exe",
"*\\Windows\\System32\\SearchProtocolHost.exe"
) and
/* System virtual process */
not process.pid == 4 and
/* svchost instances running as non privileged user sid */
not (process.executable : "*\\Windows\\System32\\svchost.exe" and process.parent.pid < 1000) and
/* excluding privileged services and third party programs */
not (user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
process.executable : ("?:\\Windows\\System32\\*.exe", "?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")) and
not (process.name : "gener8.exe" and file.path : "?:\\USERS\\*\\APPDATA\\LOCAL\\GENER8\\USER DATA\\DEFAULT\\LOGIN DATA") and
not (process.name : "ccs.exe" and file.path : "?:\\USERS\\*\\APPDATA\\LOCAL\\ENTERPRISEBANKSECUREBROWSER\\USER DATA\\DEFAULT\\LOGIN DATA") and
not (process.name : "epic.exe" and file.path : "?:\\USERS\\*\\APPDATA\\LOCAL\\EPIC PRIVACY BROWSER\\USER DATA\\DEFAULT\\LOGIN DATA") and
not (process.name : "ccss?st.exe" and file.path : "?:\\USERS\\*\\APPDATA\\LOCAL\\ESERVISSECUREBROWSER\\USER DATA\\DEFAULT\\LOGIN DATA")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/credential_access_web_browsers_password_access_via_command_line.toml
+51
View File
@@ -0,0 +1,51 @@
[rule]
description = """
Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the
built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi
and website passwords, secure notes, certificates, and Kerberos.
"""
id = "77d71ede-3025-4c71-bb99-ada7c344bf89"
license = "Elastic License v2"
name = "Web Browsers Password Access via Command Line"
os_list = ["macos"]
reference = [
"https://www.netmeister.org/blog/keychain-passwords.html",
"https://github.com/priyankchheda/chrome_password_grabber/blob/master/chrome.py",
"https://ss64.com/osx/security.html",
"https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/",
]
version = "1.0.4"
query = '''
process where event.action == "exec" and
process.name : "security" and
process.args : "-wa" and process.args : ("find-generic-password", "find-internet-password") and
process.command_line : ("*Chrome*", "*Chromium*", "*Opera*", "*Safari*", "*Brave*", "*Microsoft Edge*", "*Firefox*") and
not process.parent.executable : "/Applications/Keeper Password Manager.app/Contents/Frameworks/Keeper Password Manager Helper*/Contents/MacOS/Keeper Password Manager Helper*"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_binary_masquerading_via_untrusted_path.toml
+162
View File
@@ -0,0 +1,162 @@
[rule]
description = """
Identifies binaries that have been identically named to Windows built-in programs and being run from untrusted or
commonly abused paths. Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate
or benign.
"""
id = "35dedf0c-8db6-4d70-b2dc-a133b808211f"
license = "Elastic License v2"
name = "Binary Masquerading via Untrusted Path"
os_list = ["windows"]
version = "1.0.11"
query = '''
process where event.action == "start" and
process.name : (
"at.exe",
"atbroker.exe",
"arp.exe",
"bcdedit.exe",
"bitsadmin.exe",
"certutil.exe",
"cmstp.exe",
"conhost.exe",
"control.exe",
"cscript.exe",
"csrss.exe",
"csi.exe",
"dsget.exe",
"dfsvc.exe",
"dllhost.exe",
"dsquery.exe",
"eventvwr.exe",
"fsutil.exe",
"ieexec.exe",
"installutil.exe",
"ipconfig.exe",
"lsass.exe",
"Microsoft.Workflow.Compiler.exe",
"mmc.exe",
"msbuild.exe",
"msdt.exe",
"mshta.exe",
"msiexec.exe",
"net.exe",
"net1.exe",
"netsh.exe",
"netstat.exe",
"odbcconf.exe",
"ping.exe",
"powershell.exe",
"qprocess.exe",
"quser.exe",
"qwinsta.exe",
"reg.exe",
"regasm.exe",
"regsvcs.exe",
"regsvr32.exe",
"runas.exe",
"rundll32.exe",
"schtasks.exe",
"sdclt.exe",
"services.exe",
"spoolsv.exe",
"svchost.exe",
"taskhost.exe",
"taskhostw.exe",
"tasklist.exe",
"userinit.exe",
"vaultcmd.exe",
"vssadmin.exe",
"wininit.exe",
"winlogon.exe",
"whoami.exe",
"wmic.exe",
"wevtutil.exe",
"wscript.exe",
"gprslt.exe",
"nbtstat.exe",
"systeminfo.exe",
"VsJITDebugger.exe",
"extexport.exe",
"extexport.exe") and
not process.executable : (
"?:\\Windows\\System32\\*.exe",
"?:\\Windows\\SysWOW64\\*.exe",
"?:\\Windows\\Microsoft.NET\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\Program Files\\*.exe",
/* Issue # 295 */
"?:\\Users\\*\\AppData\\Local\\Programs\\Git\\usr\\bin\\hostname.exe",
"?:\\*\\usr\\bin\\hostname.exe",
"?:\\ProgramData\\West Wind Technologies\\Uninstall\\*\\regsvr32.exe",
"?:\\ProgramData\\chocolatey\\*.exe",
"?:\\cygwin*\\bin\\*.exe",
/* PR #685 */
"\\Device\\HarddiskVolume*\\Windows\\System32\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\Microsoft.NET\\*.exe",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
"\\Device\\HarddiskVolume*\\Program Files\\*.exe"
) and
not (process.name : "certutil.exe" and process.parent.executable : "?:\\Program Files (x86)\\Netskope\\STAgent\\stAgentUI.exe" and process.code_signature.subject_name: "netSkope Inc") and
not (process.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\*.exe" and process.code_signature.subject_name : "Lenovo") and
/* Issue #582 */
not (process.name : "certutil.exe" and process.parent.name : "cmd.exe" and process.args : "-A" and
process.parent.args : "?:\\Users\\*\\Firefox-Add_certs*\\firefox_add-certs-windows\\add-certs.cmd") and
not (process.name : "certutil.exe" and process.parent.executable : "?:\\Program Files (x86)\\DYMO\\DYMO Connect\\DYMO.WebApi.Win.Host.exe") and
/* Sfax Download Service */
not (process.name : "InstallUtil.exe" and process.parent.name : "Engine.exe" and
process.parent.args : "/OriginExe=*\\SfaxInstaller\\Sfax Windows Service.exe") and
not (process.pe.original_file_name == "RegAsm.exe" and
process.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\*\\RegAsm.exe") and
not (process.name : "regsvr32.exe" and process.parent.executable : ("?:\\ERPU\\Browser\\AutoUpgrade.exe", "?:\\ERPU\\Browser\\NeoWeb.exe")) and
not (process.name : "certutil.exe" and process.parent.name : "TOTALCMD*.EXE" and process.args_count <= 2) and
not (process.executable : "?:\\Campus\\System\\DLL\\CADability\\RegAsm.exe" and process.parent.executable : "?:\\Campus\\System\\DLL\\CADability\\RegCADability.exe") and
not (process.name : "certutil.exe" and process.args : "-d" and process.args : "-n") and
not (process.name : "services.exe" and process.args : "-i*" and process.parent.name : "monitor.exe") and
not (process.name : "RegAsm.exe" and process.args : ("directdeposit.vb.tlb", "?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")) and
not process.executable : "D:\\Reform V*\\Reform_PDC_Server_v*\\Plugins\\Monitoring\\CScript.exe" and
not (process.name : "rundll32.exe" and process.code_signature.subject_name == "Teramind Inc." and process.code_signature.trusted == true) and
not (process.name : "regsvr32.exe" and
process.args : ("?:\\Sage\\Sage300 Programs\\GL69A\\FRCOM690.DLL",
"?:\\Program Files (x86)\\*.dll",
"?:\\Program Files\\*.dll",
"?:\\WINDOWS\\system32\\*.dll")) and
not process.executable : ("?:\\Microsoft Visual Studio\\*\\Msbuild.exe", "?:\\adv\\app\\RegAsm.exe", "?:\\Windows\\WinSxS\\wow64_microsoft-windows*management-console_*\\mmc.exe") and
not (process.executable : "?:\\Engeman\\RegAsm.exe" and process.parent.executable : "?:\\Engeman\\Engeman.exe") and
not process.command_line : ("installutil /unattended Sage.CNA.WindowsService.exe ",
"installutil /u Sage.CNA.WindowsService.exe ",
"InstallUtil /i ComPlus.HelpDesk.AppServer.exe")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.004"
name = "Masquerade Task or Service"
reference = "https://attack.mitre.org/techniques/T1036/004/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_binary_proxy_execution_via_rundll32.toml
+74
View File
@@ -0,0 +1,74 @@
[rule]
description = """
Identifies the execution of a malicious application via rundll32.exe. Adversaries may abuse rundll32.exe to proxy
execution of malicious code and bypass application whitelisting configuration.
"""
id = "f60455df-5054-49ff-9ff7-1dc4e37b6ea7"
license = "Elastic License v2"
name = "Binary Proxy Execution via Rundll32"
os_list = ["windows"]
reference = [
"https://lolbas-project.github.io/lolbas/Libraries/Shell32/",
"https://lolbas-project.github.io/lolbas/Libraries/Zipfldr/",
"https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/",
"https://lolbas-project.github.io/lolbas/Libraries/Advpack/",
"https://lolbas-project.github.io/lolbas/Libraries/Ieadvpack/",
"https://lolbas-project.github.io/lolbas/Libraries/Url/",
]
version = "1.0.7"
query = '''
sequence with maxspan=1m
[process where event.action == "start" and
process.pe.original_file_name == "RUNDLL32.EXE" and
process.command_line :
("*advpack*RegisterOCX*",
"*advpack*#12*",
"*zipfldr*RouteTheCall*",
"*pcwutl*LaunchApplication*",
"*pcwutl*#1*",
"*url.dll*FileProtocolHandler*file://*",
"*url.dll*FileProtocolHandler*.exe*",
"*shell32.dll*ShellExec_RunDLL*",
"*advpack*LaunchINFSection*") and
/* Issue #265 */
not (process.command_line : "*url.dll*FileProtocolHandler*" and
process.command_line : ("*http://*", "*zoommtg://*", "*://*&*&*")) and
/* Legit LaunchApplication instances via msdt */
not (process.command_line : "*pcwutl.dll,LaunchApplication*" and
process.parent.name : "msdt.exe" and
process.working_directory : "?:\\Windows\\system32\\")] by process.entity_id
[process where event.action == "start" and
not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
not (process.name : "wscript.exe" and process.args : "Cathexis Archive Viewer.vbs") and
not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
not process.Ext.token.integrity_level_name == "system"
] by process.parent.entity_id
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_control_panel_process_with_unusual_arguments.toml
+60
View File
@@ -0,0 +1,60 @@
[rule]
description = """
Identifies instances of the Control Panel application running with suspicious keywords or paths in the process command
line value. Adversaries may abuse Control.exe to proxy execution of malicious code.
"""
id = "a4862afb-1292-4f65-a15f-8d6a8019b5e2"
license = "Elastic License v2"
name = "Control Panel Process with Unusual Arguments"
os_list = ["windows"]
version = "1.0.5"
query = '''
process where event.action == "start" and
process.executable : ("?:\\Windows\\SysWOW64\\control.exe", "?:\\Windows\\System32\\control.exe") and
process.command_line :
("*.jpg*",
"*.png*",
"*.gif*",
"*.bmp*",
"*.jpeg*",
"*.TIFF*",
"*.inf*",
"*.dat*",
"*.cpl:../*",
"*..\\..\\*",
"*/AppData/Local/*",
"*:\\Users\\Public\\*",
"*\\AppData\\Local\\*") and
/* excluding FPs where /name arg is used to specify a control by name */
not (process.args : "/name" and process.args_count >= 2) and
/* excluding system IL to minimize risk of killing system critical execution */
not process.Ext.token.integrity_level_name == "system"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.002"
name = "Control Panel"
reference = "https://attack.mitre.org/techniques/T1218/002/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_crashdump_disabled_via_registry_modification.toml
+41
View File
@@ -0,0 +1,41 @@
[rule]
description = """
Identifies attempt to disable memory crashdump via registry modification. Malware using kernel mode component may
perform this action to limit exposure in the case of an unexpected system crash.
"""
id = "77ca3fcc-f607-45e0-837e-e4173e4ffc2a"
license = "Elastic License v2"
name = "CrashDump Disabled via Registry Modification"
os_list = ["windows"]
reference = [
"https://elastic.github.io/security-research/intelligence/2022/03/01.hermeticwiper-targets-ukraine/article/",
"https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options",
]
version = "1.0.5"
query = '''
registry where registry.value : "CrashDumpEnabled" and registry.data.strings : "0" and
not (user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\msiexec.exe"))
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_execution_via_internet_explorer_exporter.toml
+42
View File
@@ -0,0 +1,42 @@
[rule]
description = """
Identifies the execution of the built-in Windows program, ExtExport, which can be used for execution via side-loading a
malicious DLL with one of the following names: mozcrt19.dll, mozsqlite3.dll, or sqlite.dll.
"""
id = "e13a65b7-f46f-4c7f-85cf-7e59170071fa"
license = "Elastic License v2"
name = "Execution via Internet Explorer Exporter"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Extexport/"]
version = "1.0.7"
query = '''
sequence by user.id with maxspan=5m
[file where event.action != "deletion" and
file.name : ("sqlite3.dll", "mozcrt19.dll", "mozsqlite3.dll") and
not file.path : ("?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")]
[process where event.action == "start" and process.pe.original_file_name : "extexport.exe" and
not process.executable : ("?:\\Program Files (x86)\\Internet Explorer\\ExtExport.exe",
"?:\\Program Files\\Internet Explorer\\ExtExport.exe")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_execution_via_renamed_signed_binary_proxy.toml
+81
View File
@@ -0,0 +1,81 @@
[rule]
description = """
Identifies built-in Windows programs that have been renamed and can be used for execution, downloads, and/or evasion.
Attackers may abuse this tactic to evade filename based detection of built-in tools.
"""
id = "b0207677-5041-470b-981d-13ab956cf5b4"
license = "Elastic License v2"
name = "Execution via Renamed Signed Binary Proxy"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io"]
version = "1.0.8"
query = '''
process where event.action == "start" and
process.name != null and
(
(process.pe.original_file_name == "cscript.exe" and not process.name : "cscript.exe") or
(process.pe.original_file_name == "wscript.exe" and not process.name : "wscript.exe") or
(process.pe.original_file_name == "PowerShell.EXE" and not process.name : "PowerShell.EXE") or
(process.pe.original_file_name == "Cmd.Exe" and not process.name : ("Cmd.Exe", "command.com")) or
(process.pe.original_file_name == "MSHTA.EXE" and not process.name : "MSHTA.EXE") or
(process.pe.original_file_name == "RUNDLL32.EXE" and not process.name : "RUNDLL32.EXE") or
(process.pe.original_file_name == "REGSVR32.EXE" and not process.name : "REGSVR32.EXE") or
(process.pe.original_file_name == "MSBuild.exe" and not process.name : "MSBuild.exe") or
(process.pe.original_file_name == "InstallUtil.exe" and not process.name : "InstallUtil.exe") or
(process.pe.original_file_name == "RegAsm.exe" and not process.name : "RegAsm.exe") or
(process.pe.original_file_name == "RegSvcs.exe" and not process.name : "RegSvcs.exe") or
(process.pe.original_file_name == "msxsl.exe" and not process.name : "msxsl.exe") or
(process.pe.original_file_name == "Microsoft.Workflow.Compiler.exe" and
not process.name : "Microsoft.Workflow.Compiler.exe") or
(process.pe.original_file_name == "msiexec.exe" and not process.name : "msiexec.exe" and
not process.executable : "?:\\Windows\\Installer\\MSI*.tmp") or
(process.pe.original_file_name == "CMSTP.EXE" and not process.name : "CMSTP.EXE") or
(process.pe.original_file_name == "bitsadmin.exe" and not process.name : "bitsadmin.exe") or
(process.pe.original_file_name == "CertUtil.exe" and not process.name : "CertUtil.exe") or
(process.pe.original_file_name == "wmic.exe" and not process.name : "wmic.exe") or
(process.pe.original_file_name == "schtasks.exe" and not process.name : "schtasks.exe") or
(process.pe.original_file_name == "wuauclt.exe" and not process.name : "wuauclt.exe") or
(process.pe.original_file_name == "Bginfo.exe" and not process.name : "Bginfo*.exe") or
(process.pe.original_file_name == "VsJITDebugger.exe" and not process.name : "VsJITDebugger.exe") or
(process.pe.original_file_name == "xwizard.exe" and not process.name : "xwizard.exe") or
(process.pe.original_file_name == "extexport.exe" and not process.name : "extexport.exe") or
(process.pe.original_file_name == "CertReq.exe" and not process.name : "CertReq.exe")
) and
/* some third party programs tend to include renamed binaries, still often run from trusted paths */
not process.executable :
(
"?:\\Windows\\System32\\*.exe",
"?:\\Windows\\SysWOW64\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\Program Files\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\Microsoft.NET\\*.exe",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
"\\Device\\HarddiskVolume*\\Program Files\\*.exe"
) and
not (process.pe.original_file_name in ("RegAsm.exe", "REGSVR32.EXE") and process.executable : "?:\\Windows\\Installer\\MSI*.tmp" and
process.parent.executable : "?:\\WINDOWS\\system32\\msiexec.exe")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_managed_.net_code_execution_via_windows_script_interpreter.toml
+87
View File
@@ -0,0 +1,87 @@
[rule]
description = """
Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious
code execution via Windows scripts.
"""
id = "5a898048-d98c-44c6-b7ba-f63a31eb3571"
license = "Elastic License v2"
name = "Managed .NET Code Execution via Windows Script Interpreter"
os_list = ["windows"]
reference = [
"https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html",
"https://github.com/med0x2e/GadgetToJScript",
"https://github.com/mdsecactivebreach/SharpShooter",
]
version = "1.0.4"
query = '''
sequence by process.entity_id with maxspan=2m
[process where event.type == "start" and
process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") and
/* Only FPs observed so far, similar FPs can be handled via user custom applied exclusions */
not (process.name : "mshta.exe" and process.parent.name : "Explorer.exe" and
process.working_directory : "H:\\Code\\SignatureGen\\") and
not (process.name : "wscript.exe" and process.parent.name : "wscript.exe" and
process.parent.args : "/ChangedHostBitness" and process.parent.args : "/ALL")]
[file where event.action == "creation" and
file.path : "?:\\Users\\*\\Microsoft\\CLR_*\\UsageLogs\\*.exe.log" and
/*
CLR Usage Logs are created only for the first time
the program executes .NET which should reduce noise compared to clr.dll imageload
*/
file.name : ("wscript.exe.log",
"cscript.exe.log",
"mshta.exe.log",
"wmic.exe.log",
"cmstp.exe.log",
"msxsl.exe.log")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique]]
id = "T1220"
name = "XSL Script Processing"
reference = "https://attack.mitre.org/techniques/T1220/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_modification_of_safari_settings_via_defaults_command.toml
+43
View File
@@ -0,0 +1,43 @@
[rule]
description = """
Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or
disable certain Safari settings, such as enabling JavaScript from Apple Events to ease the user's browser's hijacking.
"""
id = "396e1138-243c-4215-a8ed-be303204710d"
license = "Elastic License v2"
name = "Modification of Safari Settings via Defaults Command"
os_list = ["macos"]
reference = ["https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf"]
version = "1.0.5"
query = '''
process where event.type == "start" and
process.name : "defaults" and process.args : "write" and
process.command_line : "*com.apple.Safari*" and process.command_line : ("*IncludeDevelopMenu*", "*JavaScript*")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_msbuild_with_unusual_arguments.toml
+59
View File
@@ -0,0 +1,59 @@
[rule]
description = """
Identifies the execution of the built-in MSBuild utility with a suspicious count of command line arguments (less than
three). Adversaries may use MSBuild to proxy the execution of malicious code via a trusted Windows utility.
"""
id = "6518cdaf-e6cd-4cf9-a51e-043117c3dbeb"
license = "Elastic License v2"
name = "MSBuild with Unusual Arguments"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Msbuild/"]
version = "1.0.5"
query = '''
process where event.action == "start" and
process.pe.original_file_name == "MSBuild.exe" and process.args_count == 2 and
/* FP - expected developers msbuild installation directories */
not process.executable : ("?:\\Program Files (x86)\\Microsoft Visual Studio\\*",
"?:\\Program Files\\Microsoft Visual Studio\\*") and
not process.command_line : ("* /*", "* .\\*", "*.proj*", "*.sln*") and
/* FP - Third Party Programs except MS Office */
not (process.parent.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and
not process.parent.name :
("winword.exe",
"excel.exe",
"outlook.exe",
"powerpnt.exe",
"eqnedt32.exe",
"fltldr.exe",
"mspub.exe",
"msaccess.exe"))
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1127"
name = "Trusted Developer Utilities Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1127/"
[[threat.technique.subtechnique]]
id = "T1127.001"
name = "MSBuild"
reference = "https://attack.mitre.org/techniques/T1127/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_network_connection_via_process_with_unusual_arguments.toml
+79
View File
@@ -0,0 +1,79 @@
[rule]
description = """
Identifies suspicious network connections from Windows processes that typically have more than one command line
argument. This may be indicative of a masquerading attempt to evade detections that monitor for suspicious parent-child
process relationships.
"""
id = "95601d8b-b969-4189-9744-090140ae29e6"
license = "Elastic License v2"
name = "Network Connection via Process with Unusual Arguments"
os_list = ["windows"]
version = "1.0.8"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and process.args_count == 1 and
process.name :
("AddInProcess.exe",
"AddInProcess32.exe",
"AddInUtil.exe",
"AppLaunch.exe",
"aspnet_compiler.exe",
"aspnet_regbrowsers.exe",
"aspnet_regiis.exe",
"aspnet_regsql.exe",
"aspnet_state.exe",
"aspnet_wp.exe",
"CasPol.exe",
"ComSvcConfig.exe",
"csc.exe",
"cvtres.exe",
"DataSvcUtil.exe",
"EdmGen.exe",
"ilasm.exe",
"InstallUtil.exe",
"jsc.exe",
"Microsoft.Workflow.Compiler.exe",
"MSBuild.exe",
"mscorsvw.exe",
"ngen.exe",
"ngentask.exe",
"RegAsm.exe",
"RegSvcs.exe",
"ServiceModelReg.exe",
"vbc.exe",
"WsatConfig.exe",
"dllhost.exe",
"regsvr32.exe",
"GPUpdate.exe",
"SearchProtocolHost.exe",
/* Issue #639 - added msiexec */
"msiexec.exe")]
[network where event.action == "connection_attempted"]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_operating_system_security_updates_disabled.toml
+44
View File
@@ -0,0 +1,44 @@
[rule]
description = """
Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in
an attempt to disable security updates.
"""
id = "741ad90d-e8d0-4d29-b91b-3d68108cb789"
license = "Elastic License v2"
name = "Operating System Security Updates Disabled"
os_list = ["macos"]
reference = ["https://blog.checkpoint.com/2017/07/13/osxdok-refuses-go-away-money/"]
version = "1.0.4"
query = '''
process where event.type == "start" and
process.name == "defaults" and
process.args : "write" and process.args : "-bool" and
process.command_line : "*com.apple.SoftwareUpdate*" and process.args : "CriticalUpdateInstall" and process.args : "NO"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_parent_process_pid_spoofing.toml
+115
View File
@@ -0,0 +1,115 @@
[rule]
description = """
Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID)
of a new process to evade process-monitoring defenses or to elevate privileges.
"""
id = "816ba7e7-519a-4f85-be2a-bacd6ccde57f"
license = "Elastic License v2"
name = "Parent Process PID Spoofing"
os_list = ["windows"]
reference = ["https://blog.didierstevens.com/2017/03/20/"]
version = "1.0.8"
query = '''
sequence with maxspan=5m
[process where event.action == "start" and
process.parent.executable != null and
/* FP - AppInfo */
not (process.executable : "?:\\windows\\system32\\svchost.exe" and
user.id == "S-1-5-18" and process.command_line : "* -k netsvcs*") and
/* FP - Windows Errors Reporting */
not (process.executable : "?:\\windows\\system32\\svchost.exe" and
user.id == "S-1-5-18" and process.command_line : "*WerSvcGroup*") and
/* FP - Secondary Logon */
not (process.executable : "?:\\windows\\system32\\svchost.exe" and
user.id == "S-1-5-18" and process.command_line : "*seclogon*") and
/* FP - Application Brokers */
not (process.executable : ("?:\\Windows\\System32\\RuntimeBroker.exe",
"?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe")) and
/* FP - Third Party Programs except MS Office */
not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and
process.code_signature.trusted == true and
not process.name : ("winword.exe",
"excel.exe",
"outlook.exe",
"powerpnt.exe",
"eqnedt32.exe",
"fltldr.exe",
"mspub.exe",
"msaccess.exe")) and
/* FP Issue #488 - WerFaultSecure ProtectedCrash */
not (
process.executable : ("?:\\Windows\\System32\\WerFaultSecure.exe", "?:\\WINDOWS\\SysWOW64\\WerFaultSecure.exe") and
user.id == "S-1-5-18" and process.parent.command_line != null and
((process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.parent.command_line : "*WerSvcGroup*") or
process.parent.executable : "?:\\Windows\\System32\\dxgiadaptercache.exe")
) and
/* FP Issue #488 - File Picker UI Host is real parent of Authentication Broker AuthHost.exe */
not (process.executable : "?:\\Windows\\System32\\PickerHost.Exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
/* FP Issue #488 - Roblox Game Client */
not (process.pe.original_file_name : "RobloxApp.exe" and
process.code_signature.subject_name == "Roblox Corporation" and process.code_signature.trusted == true) and
/* FP OpenWith handles unknown file handlers via GUI popup */
not (process.executable : ("?:\\WINDOWS\\system32\\OpenWith.exe", "?:\\WINDOWS\\syswow64\\OpenWith.exe") and process.args: "-Embedding" and
process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.parent.args : "DcomLaunch") and
not (process.pe.original_file_name : "notification_helper.exe" and process.code_signature.subject_name == "Microsoft Corporation" and
process.code_signature.trusted == true) and
not (process.pe.original_file_name : "pmlauncher.exe" and process.code_signature.subject_name == "BeyondTrust Software, Inc" and
process.code_signature.trusted == true) and
not (process.executable : "?:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_*\\MicrosoftEdge.exe" and
process.Ext.token.integrity_level_name == "low" and process.parent.executable : "?:\\Windows\\system32\\svchost.exe" and process.parent.args : "DcomLaunch") and
not (process.pe.original_file_name == "MBSetup.exe" and process.code_signature.subject_name == "Malwarebytes Inc" and
process.code_signature.trusted == true) and
not (process.executable : "?:\\Windows\\System32\\backgroundTaskHost.exe" and process.Ext.token.integrity_level_name == "low" and process.parent.name : "svchost.exe")
] by process.entity_id
[process where event.action == "start" and process.parent.Ext.real.pid > 0 and
/* FP Issue #488 - Auth Host Broker for WindowsApps */
not process.executable : "?:\\Windows\\system32\\AuthHost.exe" and
not (process.parent.executable : "?:\\Windows\\System32\\sihost.exe" and
process.pe.original_file_name : ("chrome.exe", "msedge.exe") and process.args_count >= 2 and
process.code_signature.subject_name : ("Google LLC", "Microsoft Corporation"))] by process.parent.Ext.real.entity_id
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.004"
name = "Parent PID Spoofing"
reference = "https://attack.mitre.org/techniques/T1134/004/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_potential_defense_evasion_via_filter_manager_control_program.toml
+40
View File
@@ -0,0 +1,40 @@
[rule]
description = "Identifies attempt to unload a security driver via the Filter Manager Control Program."
id = "5b39f347-077c-4a1e-8d3c-6f7789ca09e8"
license = "Elastic License v2"
name = "Potential Defense Evasion via Filter Manager Control Program"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/FltMC/"]
version = "1.0.5"
query = '''
process where event.action == "start" and
process.pe.original_file_name == "fltMC.exe" and
process.args : "unload" and process.command_line : ("*security*", "*sysmon*", "*esensor*", "*Elastic*")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_potential_masquerading_as_svchost.toml
+72
View File
@@ -0,0 +1,72 @@
[rule]
description = """
Identifies the creation of a svchost process with an unusual parent. This may indicate an attempt to masquerade a
malicious process.
"""
id = "5b00c9ba-9546-47cc-8f9f-1c1a3e95f65c"
license = "Elastic License v2"
name = "Potential Masquerading as SVCHOST"
os_list = ["windows"]
version = "1.0.6"
query = '''
process where event.action == "start" and
process.name : "svchost.exe" and
process.parent.executable != null and
not process.parent.executable : (
"?:\\Windows\\System32\\services.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
"?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
"?:\\Program Files*\\Windows Defender\\MsMpEng.exe",
"?:\\Windows\\*\\rpcnet*.exe",
"?:\\Windows\\System32\\MRT.exe",
"?:\\Windows\\System32\\MRT-*.exe",
"?:\\Program Files*\\Unity Client\\Unity.exe",
"?:\\Windows\\System32\\wermgr.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\services.exe",
"\\Device\\HarddiskVolume?\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
"\\Device\\HarddiskVolume?\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
"\\Device\\HarddiskVolume?\\Program Files*\\Windows Defender\\MsMpEng.exe",
"\\Device\\HarddiskVolume?\\Windows\\*\\rpcnet*.exe",
"\\Device\\HarddiskVolume?\\Windows\\system32\\MRT.exe",
"\\Device\\HarddiskVolume?\\Program Files*\\Unity Client\\Unity.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\wermgr.exe"
) and
not (process.parent.executable : "?:\\Windows\\system32\\svchost.exe" and process.executable : "?:\\Windows\\syswow64\\svchost.exe") and
not (process.parent.executable :
("?:\\Windows\\System32\\svchost.exe",
"?:\\Program Files\\COMODO\\COMODO Internet Security\\cmdvirth.exe",
"?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\acrocef*\\RdrCEF.exe") and
process.Ext.token.integrity_level_name == "system") and
not (process.pe.original_file_name == "AsDVDLock.exe" and
process.executable : "?:\\Program Files (x86)\\ASUS\\ASUS Manager\\USB Lock\\svchost.exe") and
not (process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and
process.parent.args : "ClipboardSvcGroup" and process.executable : "?:\\Windows\\System32\\svchost.exe")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.004"
name = "Masquerade Task or Service"
reference = "https://attack.mitre.org/techniques/T1036/004/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_potential_parent_process_pid_spoofing_via_malseclogon.toml
+78
View File
@@ -0,0 +1,78 @@
[rule]
description = """
Identifies potential parent process spoofing via abusing the seclogon service. Adversaries may spoof the parent process
identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.
"""
id = "3bd31cbf-b581-41b7-b021-020cc64cfd9d"
license = "Elastic License v2"
name = "Potential Parent Process PID Spoofing via MalSecLogon"
os_list = ["windows"]
reference = ["https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html"]
version = "1.0.7"
query = '''
sequence with maxspan=1m
[process where event.action == "start" and process.name : "svchost.exe" and process.args : "seclogon"] by process.entity_id
[process where event.action == "start" and
process.parent.Ext.real.pid > 0 and not process.Ext.token.integrity_level_name == "system" and
/* dirs hosting interesting processes to spoof as parent process like Explorer.exe */
process.parent.executable : ("?:\\Windows\\System32\\*.exe", "?:\\Windows\\SysWOW64\\*.exe") and
/* common secLogon Clients running from trusted directories */
not (process.parent.executable : "?:\\WINDOWS\\Explorer.EXE" and process.name : "rundll32.exe" and process.command_line : "*SHELL32.dll,RunAsNewUser_RunDLL*") and
not (process.parent.executable : ("?:\\Windows\\System32\\runas.exe", "?:\\WINDOWS\\system32\\ShellRunas.exe") and process.parent.args_count >= 2) and
not (process.parent.executable : "?:\\WINDOWS\\System32\\svchost.exe" and process.parent.args : "WdiServiceHost" and
process.name : "rundll32.exe" and process.command_line : "*winethc.dll*ForceProxyDetectionOnNextRun*") and
not (process.parent.executable : "?:\\Windows\\Sys*\\OneDriveSetup.exe" and process.parent.args : ("/thfirstsetup", "/uninstall") and
process.pe.original_file_name in ("OneDrive.exe", "OneDriveSetup.exe") and
process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) and
not (process.parent.executable : "?:\\Windows\\Sys*\\MsiExec.exe" and process.parent.args : "-Embedding") and
not (process.parent.executable : "?:\\Windows\\System32\\consent.exe" and process.executable : "?:\\WINDOWS\\system32\\UserAccountControlSettings.exe") and
/* RunAs execution via windows scripts */
not process.parent.name : ("cscript.exe", "powershell.exe", "wscript.exe") and
not process.parent.executable : ("?:\\windows\\system32\\ServerManager.exe", "?:\\Windows\\System32\\LogonUI.exe", "?:\\Windows\\System32\\dgagent\\dsagent.exe") and
not (process.parent.executable : "?:\\Windows\\System32\\DriverStore\\FileRepository\\*\\AircommandEngine.exe" and
process.executable : "?:\\Windows\\System32\\DriverStore\\FileRepository\\*\\AircommandEngine.exe") and
not (process.parent.executable : "?:\\Windows\\System32\\mmc.exe" and process.executable : "?:\\Windows\\system32\\gpupdate.exe") and
not (process.pe.original_file_name == "OffCATcmd.exe" and process.code_signature.subject_name == "Microsoft Corporation" and
process.code_signature.trusted == true and process.parent.executable : "?:\\Windows\\System32\\sdiagnhost.exe") and
not (process.parent.name : "rundll32.exe" and process.parent.args : "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc")] by process.parent.Ext.real.entity_id
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.004"
name = "Parent PID Spoofing"
reference = "https://attack.mitre.org/techniques/T1134/004/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_potential_privacy_control_bypass_via_localhost_secure_copy.toml
+54
View File
@@ -0,0 +1,54 @@
[rule]
description = """
Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell
Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS
privacy controls to access sensitive files.
"""
id = "55df8e91-fd3c-4cc1-b36f-f01ded8c6da3"
license = "Elastic License v2"
name = "Potential Privacy Control Bypass via Localhost Secure Copy"
os_list = ["macos"]
reference = [
"https://blog.trendmicro.com/trendlabs-security-intelligence/xcsset-mac-malware-infects-xcode-projects-performs-uxss-attack-on-safari-other-browsers-leverages-zero-day-exploits/",
]
version = "1.0.4"
query = '''
process where event.type == "start" and
process.name == "scp" and
process.args : "StrictHostKeyChecking=no" and
process.command_line : ("*scp *localhost:/*", "*scp *127.0.0.?:/*") and not process.command_line : "*vagrant@*127.0.0.1*"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1548"
name = "Abuse Elevation Control Mechanism"
reference = "https://attack.mitre.org/techniques/T1548/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_potential_self_deletion_of_a_running_executable.toml
+47
View File
@@ -0,0 +1,47 @@
[rule]
description = """
Identifies the execution of a file followed by the rename of its primary file stream. This may indicate an attempt to
delete the currently running process executable file on disk, bypassing the file lock restriction. Adversaries may
delete files left behind by the actions of their intrusion activity.
"""
id = "24082642-49a7-4072-952b-10c244b24f8e"
license = "Elastic License v2"
name = "Potential Self Deletion of a Running Executable"
os_list = ["windows"]
reference = ["https://github.com/LloydLabs/delete-self-poc"]
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
process.executable : ("?:\\Users\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*", "?:\\Python*")] by process.name
[file where event.action == "rename" and
/* Rename the primary file stream */
file.name : "*:*" and not file.Ext.original.name : "*:*" and file.size == 0] by file.Ext.original.name
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal on Host"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.004"
name = "File Deletion"
reference = "https://attack.mitre.org/techniques/T1070/004/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_process_executable_image_tampering_attempt.toml
+47
View File
@@ -0,0 +1,47 @@
[rule]
description = """
Identifies attempts to tamper with the executable file of a process. Attackers may attempt to tamper with the executable
file of a process in order to run or inject malicious code via techniques such as Process Ghosting or Process
Doppelgänging. Attackers may use these techniques in attempts to evade process-based defenses and in some cases, to
elevate privileges. Process Ghosting is a technique where an attacker can write a malicious file to disk in such a way
that it is difficult for security tools to scan or delete - and where the deleted malicious file is subsequently
executed as though it were a regular file on disk. Process Doppelgänging is a technique that exploits Transactional NTFS
to execute arbitrary code in the address space of a separate running process, without committing the code to disk.
"""
id = "905f4c30-a8c5-40a5-80e3-a50c6714632f"
license = "Elastic License v2"
name = "Process Executable Image Tampering Attempt"
os_list = ["windows"]
reference = ["https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack"]
version = "1.0.7"
query = '''
process where event.action == "start" and
process.Ext.defense_evasions : "Process Tampering: Image is locked for access"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.013"
name = "Process Doppelgänging"
reference = "https://attack.mitre.org/techniques/T1055/013/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_protected_process_light_bypass_via_dll_tampering.toml
+61
View File
@@ -0,0 +1,61 @@
[rule]
description = """
Identifies attempts to tamper with a DLL associated with a Protected Process Light (PPL) process. The purpose of PPL is
to protect critical system processes against modification, access, or tampering via open process functions. An attacker
may attempt to tamper with the DLL associated with a PPL process in order to bypass PPL protection and inject malicious
code into the protected process, elevating their privileges. This privilege escalation can enable them to evade or
disable security software, and access sensitive information such as credentials.
"""
id = "905f4c30-a8c5-40a5-80e3-a50c5613432f"
license = "Elastic License v2"
name = "Protected Process Light Bypass via DLL Tampering"
os_list = ["windows"]
reference = ["https://googleprojectzero.blogspot.com/2018/08/windows-exploitation-tricks-exploiting.html"]
version = "1.0.8"
query = '''
sequence by process.entity_id with maxspan=3s
[process where event.action == "start" and process.Ext.protection != null and
process.Ext.protection != "PsProtectedSignerAntimalware-Light" and
not (process.executable : "?:\\Windows\\System32\\svchost.exe" and process.args == "WaaSMedicSvc" and
process.parent.executable : "?:\\Windows\\System32\\services.exe")]
[library where dll.Ext.defense_evasions : "Process Tampering: Code integrity violation" and
not (dll.code_signature.trusted == true and
dll.code_signature.subject_name :
("ESET, spol. s r.o.",
"Acronis International GmbH",
"Kaseya Corporation",
"Veeam Software Group GmbH",
"Trend Micro, Inc.",
"Sophos Ltd",
"DeviceLock, Inc")) and
not process.executable : "?:\\Program Files (x86)\\Common Files\\BattlEye\\BEService.exe" and
/* potential services child processes */
not (process.executable : "?:\\Windows\\System32\\services.exe" and dll.name : "*.exe")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.16.0"
behavior/rules/defense_evasion_regsvr32_scriptlet_execution.toml
+62
View File
@@ -0,0 +1,62 @@
[rule]
description = """
Identifies the native Windows tool, regsvr32.exe, executing a scriptlet file. This can allow an attacker to bypass
whitelisting and run arbitrary scripts.
"""
id = "0524c24c-e45e-4220-b21a-abdba0c46c4d"
license = "Elastic License v2"
name = "Regsvr32 Scriptlet Execution"
os_list = ["windows"]
version = "1.0.7"
query = '''
process where event.action == "start" and
(process.pe.original_file_name : "regsvr32.exe" or process.name : "regsvr32.exe") and
(
(process.command_line : "*scrobj*" and process.command_line : ("* /i:*", "* -i:*", "*.sct*")) or
/* attackers may rename scrobj.dll */
(
process.command_line : "* /u*" and
process.command_line :
(
"* /i:C:\\*",
"* /i:\"C:\\*",
"* -i:C:\\*",
"* -i:\"C:\\*",
"* /i:*http*",
"* -i:*http*"
)
)
) and
/* Issue #326 */
not (process.Ext.token.integrity_level_name == "system" and not process.command_line : "*scrobj.dll*") and
not process.command_line : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*") and
not (process.parent.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe", "?:\\Windows\\system32\\msiexec.exe") and
not process.command_line : "*scrobj.dll*")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_regsvr32_with_unusual_arguments.toml
+75
View File
@@ -0,0 +1,75 @@
[rule]
description = """
Identifies unusual instances of Regsvr32 with suspicious keywords or paths in the process command line value.
Adversaries may abuse regsvr32.exe to proxy execution of malicious code.
"""
id = "5db08297-bf72-49f4-b426-f405c2b01326"
license = "Elastic License v2"
name = "Regsvr32 with Unusual Arguments"
os_list = ["windows"]
version = "1.0.9"
query = '''
process where event.action == "start" and process.name : "regsvr32.exe" and
process.command_line :
("*.jpg*",
"*.png*",
"*.gif*",
"*.bmp*",
"*.jpeg*",
"*.TIFF*",
"*.tmp*",
"*.dat*",
"*.pdf*",
"*.doc*",
"*.xls*",
"*.ppt*",
"*.txt*",
"* ?:/*/*",
"* ..\\*",
"*DumpStack.log*",
"*:\\Users\\Public\\*",
"*:\\Users\\*\\Documents\\*",
"*:\\Users\\*\\Pictures\\*",
"*:\\Users\\*\\Music\\*",
"*:\\Users\\*\\Pictures\\*",
"*:\\Windows\\Tasks\\*",
"*:\\Windows\\System32\\tasks\\*") and not
process.command_line : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and
/* path traversal */
not (process.command_line : "* ..\\*" and process.command_line :"* ..\\*\\*") and
not process.parent.executable : "?:\\Program Files (x86)\\Tencent\\QQPCMgr\\*\\QQPCTray.exe" and
not process.command_line :
("*\\Program Files (x86)\\Tencent\\QQPCMgr\\*.dat*",
"*QQPCMgr*TSWebMon64.dat*",
"*BarTender Suite\\Codejock.DockingPane.x64.v15.3.1.ocx*") and
not process.parent.executable : "?:\\Eaglesoft\\Shared Files\\OcxReg.exe" and
not process.args : ("?:\\windows\\system32\\ChartFX.ClientServer.Data.dll", "?:\\Windows\\SysWOW64\\ChartFX.ClientServer.Data.dll")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_remote_file_execution_via_msiexec.toml
+50
View File
@@ -0,0 +1,50 @@
[rule]
description = """
Identifies the execution of the built-in Windows Installer, MSIEXEC, with a url in the command line. Adversaries may
abuse msiexec.exe to launch local or network accessible MSI files.
"""
id = "8ba98e28-d83e-451e-8df7-f0964f7e69b6"
license = "Elastic License v2"
name = "Remote File Execution via MSIEXEC"
os_list = ["windows"]
reference = [
"https://lolbas-project.github.io/lolbas/Binaries/Msiexec/",
"https://www.guardicore.com/labs/purple-fox-rootkit-now-propagates-as-a-worm/",
]
version = "1.0.7"
query = '''
process where event.action == "start" and process.args_count <= 4 and
process.pe.original_file_name : "msiexec.exe" and process.args : "http*" and
process.args : ("/i", "-i") and
process.args : ("/q", "/quiet", "/qn", "-q", "-quiet", "-qn") and
not descendant of
[process where event.action == "start" and process.name : "*setup*" and process.code_signature.trusted == true] and
not process.Ext.token.integrity_level_name == "system"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_remote_msi_package_installation_via_msiexec.toml
+49
View File
@@ -0,0 +1,49 @@
[rule]
description = """
Identifies the execution of the built-in Windows Installer, MSIEXEC, to install a remote package. Adversaries may abuse
msiexec.exe to launch local or network accessible MSI files.
"""
id = "706bf4ca-45b7-4eb1-acae-b1228124594a"
license = "Elastic License v2"
name = "Remote MSI Package Installation via MSIEXEC"
os_list = ["windows"]
reference = [
"https://lolbas-project.github.io/lolbas/Binaries/Msiexec/",
"https://www.guardicore.com/labs/purple-fox-rootkit-now-propagates-as-a-worm/",
]
version = "1.0.5"
query = '''
sequence with maxspan=1m
[registry where process.name : "msiexec.exe" and
registry.value : "InstallSource" and registry.data.strings : "http*"] by process.entity_id
[process where event.action == "start" and
process.parent.name : "msiexec.exe" and process.parent.args : "/V" and user.id : "S-1-5-21*" and
not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true)] by process.parent.entity_id
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_renamed_autoit_scripts_interpreter.toml
+41
View File
@@ -0,0 +1,41 @@
[rule]
description = """
Identifies suspicious AutoIT process execution events. Attackers may rename an AutoIT executable file in an attempt to
avoid signature-based detection.
"""
id = "99f2327e-871f-4b8a-ae75-d1c4697aefe4"
license = "Elastic License v2"
name = "Renamed AutoIt Scripts Interpreter"
os_list = ["windows"]
version = "1.0.5"
query = '''
process where event.action == "start" and
process.pe.original_file_name : "AutoIt*.exe" and not process.name : "AutoIt*.exe"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.003"
name = "Rename System Utilities"
reference = "https://attack.mitre.org/techniques/T1036/003/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_renamed_third_party_administrator_tools.toml
+48
View File
@@ -0,0 +1,48 @@
[rule]
description = "Identifies third party administrative tools commonly used by adversaries but running with unexpected file names."
id = "b707de5c-8e4d-4d2c-be22-b09a7e82b73f"
license = "Elastic License v2"
name = "Renamed Third Party Administrator Tools"
os_list = ["windows"]
version = "1.0.8"
query = '''
process where event.action == "start" and
(
(process.pe.original_file_name : "procdump" and
process.code_signature.subject_name == "Microsoft Corporation" and not process.name : "*procdump*.exe") or
(process.pe.original_file_name : "psexec.c" and process.code_signature.subject_name == "Microsoft Corporation" and not process.name : "*psexec*.exe") or
(process.pe.original_file_name : "sdelete.exe" and process.code_signature.subject_name == "Microsoft Corporation" and not process.name : "*sdelete*")
) and
not process.executable :
("?:\\Windows\\System32\\*.exe",
"?:\\Windows\\SysWOW64\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\Program Files\\*.exe")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.003"
name = "Rename System Utilities"
reference = "https://attack.mitre.org/techniques/T1036/003/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_renamed_windows_automaton_script_interpreter.toml
+77
View File
@@ -0,0 +1,77 @@
[rule]
description = """
Identifies suspicious execution of commonly abused third party Windows automation script interpreters. Attackers may
rename AutoHotKey, Rebol or KIXTART executable files or execute scripts from suspicious paths in an attempt to avoid
signature-based detection.
"""
id = "92d720dd-93b2-49e0-b68a-d5d6acbe4910"
license = "Elastic License v2"
name = "Renamed Windows Automaton Script Interpreter"
os_list = ["windows"]
reference = ["https://blog.morphisec.com/explosive-new-mirrorblast-campaign-targets-financial-companies"]
version = "1.0.5"
query = '''
process where event.action == "start" and
(
/* renamed */
(process.pe.original_file_name : "AutoHotkey.exe" and not process.name : "AutoHotkey*.exe") or
(process.pe.original_file_name : "KIX32.EXE" and not process.name : "KIX*.EXE") or
(process.name : "rebol-view*.exe" and process.parent.name : "msiexec.exe") or
(process.name : ("AutoHotkey*.exe", "KIX32.EXE", "rebol-view*.exe") and
/* execution from common suspicious paths */
process.args : ("?:\\Users\\Public\\*",
"?:\\ProgramData\\*",
"?:\\Users\\*\\AppData\\*",
"?:\\Windows\\Temp\\*",
"?:\\Windows\\Tasks\\*")) or
/* legit rebol script interpreter has no original file name thus adding this hash abused by mirrorblast*/
process.hash.sha256 : "215e28f9660472b6271a9902573c9d190e4d7ccca33fcf8d6054941d52a3ab85" or
/* unusual script extension */
(process.name : ("rebol-view*.exe", "AutoHotkey*.exe", "KIX*.EXE") and process.args_count == 2 and
not process.command_line : ("*.ahk*", "*.rb*", "*.kix*", "*.scr*", "*.bms"))
) and
/* FP - chocolatey installs and runs Autohotkey from programdata */
not (process.pe.original_file_name == "AutoHotkey.exe" and
process.executable : ("?:\\ProgramData\\chocolatey\\*",
"?:\\Program Files\\AutoHotkey\\AutoHotkey*.exe",
"?:\\Program Files (x86)\\AutoHotkey\\AutoHotkey*.exe")) and
not (process.executable : "?:\\ProgramData\\chocolatey\\lib\\autohotkey.install\\tools\\AutoHotkey_*setup.exe" and
process.parent.executable : "?:\\ProgramData\\chocolatey\\choco.exe") and
not (process.pe.original_file_name == "KIX32.EXE" and process.command_line : "*\\NETLOGON\\*") and
not (process.pe.original_file_name == "KIX32.EXE" and process.parent.command_line : "*\\netlogon\\*") and
not (process.pe.original_file_name == "KIX32.EXE" and process.executable : ("C:\\kworking\\Bin\\RMMKSE.EXE", "C:\\kworking\\Bin\\RMMSSE.EXE")) and
not (process.pe.original_file_name == "AutoHotkey.exe" and process.executable : "C:\\TCPU73\\Programm\\ClockTC\\ClockTC.exe" and
process.parent.executable : "C:\\TCPU73\\TOTALCMD.EXE")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.003"
name = "Rename System Utilities"
reference = "https://attack.mitre.org/techniques/T1036/003/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_rundll32_regsvr32_loads_a_dll_downloaded_via_bits.toml
+61
View File
@@ -0,0 +1,61 @@
[rule]
description = """
Identifies when RunDLL32 or Regsvr32 loads an executable downloaded via Microsoft BITS Jobs. An adversary may leverage
this technique to avoid suspicious processes making network connections and executing a malicious DLL.
"""
id = "74c1fd79-5961-4f1d-8ff8-b810b7c88545"
license = "Elastic License v2"
name = "RunDLL32/Regsvr32 Loads a DLL Downloaded via BITS"
os_list = ["windows"]
reference = [
"https://blog.menasec.net/2021/05/hunting-for-suspicious-usage-of.html",
"https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-2",
]
version = "1.0.6"
query = '''
sequence with maxspan=5m
[file where event.action : "rename" and
/* Executable File downloaded via BITS */
(file.extension : ("dll", "cpl", "ocx") or file.Ext.header_bytes : "4d5a*") and process.name : "svchost.exe" and
file.Ext.original.name : "BIT*.tmp"] by file.path
[library where process.name : ("rundll32.exe", "regsvr32.exe") and
not dll.code_signature.trusted == true and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
not dll.path : ("?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")] by dll.path
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1197"
name = "BITS Jobs"
reference = "https://attack.mitre.org/techniques/T1197/"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.16.0"
behavior/rules/defense_evasion_rundll32_with_unusual_arguments.toml
+115
View File
@@ -0,0 +1,115 @@
[rule]
description = """
Identifies unusual instances of RunDLL32 with suspicious keywords or paths in the process command line value.
Adversaries may abuse rundll32.exe to proxy execution of malicious code.
"""
id = "cfaf983e-1129-464c-b0aa-270f42e20d3d"
license = "Elastic License v2"
name = "RunDLL32 with Unusual Arguments"
os_list = ["windows"]
version = "1.0.9"
query = '''
process where event.action == "start" and process.name : "rundll32.exe" and
(
/* suspicious extensions and paths */
(process.command_line : "*\\AppData\\Local\\Temp\\*,*" and not process.command_line : "*.dll*") or
process.command_line :
("*.jpg*,*",
"*.png*,*",
"*.gif*,*",
"*.bmp*,*",
"*.jpeg*,*",
"*.TIFF*,*",
"*.tmp*,*",
"*.dat*,*",
"*.txt*,*",
"* ?:/*/*",
"* ..\\*",
"*:\\Users\\Public\\*,*",
"*:\\Users\\*\\Documents\\*,*",
"*:\\Users\\*\\Pictures\\*,*",
"*:\\Users\\*\\Music\\*,*",
"*:\\Windows\\Tasks\\*,*",
"*:\\Windows\\System32\\tasks\\*,*",
"*:\\Documents and Settings\\*,*",
/* Issue #371 */
"*.bin,*",
"*.log,*",
"*.nki,*",
"*\\M?-*.dll,_run@*",
"*%TEMP%\\*.cpl*",
"*\\Users\\*\\Downloads\\*.cpl*",
"*\\appdata\\roaming\\microsoft\\templates\\*,*") or
process.command_line like "*rUNdlL32.eXe*" or
/* fake Control_RunDLL export */
(process.command_line : "*Control_RunDLL*" and not process.command_line : "*shell32.dll*Control_RunDLL*") or
/* delayed execution */
(process.parent.name : "cmd.exe" and process.parent.args : ("timeout", "ping", "choice") and process.parent.args : ("/nobreak", "/n", "/t")) or
/* execution from temp with suspicious parent process tree */
(process.command_line : "*\\AppData\\Local\\Temp\\*" and process.parent.name : ("wscript.exe", "cscript.exe", "wmiprvse.exe")) or
/* suspicious parent powershell args */
(process.parent.name : "powershell.exe" and
process.parent.args : ("-enc", "IEX", "*wp-content*", "*wp-admin*", "*wp-includes*", "*$*$*$*$*$*", "*^*^*^*^*^*^*^*^*^*", "*.replace*"))
)
/* False Positives */
and not
process.command_line :
("*JOBID=*",
"*davclnt.dll,DavSetCookie*",
"*PhotoViewer.dll*ImageView_Fu*",
"*url.dll,FileProtocolHandler*",
"*zzzzInvokeManagedCustomActionOutOfProc*",
"*,DeferredDelete*",
"*:\\WINDOWS\\system32\\spool\\*",
"*:\\Program Files (x86)\\*",
"*:\\Program Files\\*",
/* Issue #282 - FP */
"*cryptext.dll,CryptExtAddPFX*",
"*dfshim.dll*ShOpenVerbShortcut*",
"*\\Documents\\DocuShare\\*",
/* Issue #371 */
"*ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile*",
"*FirewallControlPanel.dll,ShowNotificationDialog*",
"*--type=renderer*--log-file=*",
"*--lang=*--log-file=*") and not
(process.command_line : "*.tmp*" and
process.parent.executable : ("?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\System32\\msiexec.exe") and
process.parent.args : "-Embedding") and
not process.args : "?:\\ProgramData\\Parallels\\RASLogs\\tmp*.tmp,StopMemshell"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_script_execution_via_microsoft_html_application.toml
+87
View File
@@ -0,0 +1,87 @@
[rule]
description = """
Identifies the execution of scripts via HTML applications using Windows utilities rundll32.exe or mshta.exe. Adversaries
may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries.
"""
id = "f0630213-c4c4-4898-9514-746395eb9962"
license = "Elastic License v2"
name = "Script Execution via Microsoft HTML Application"
os_list = ["windows"]
version = "1.0.9"
query = '''
process where event.action == "start" and
(process.name : ("rundll32.exe", "mshta.exe") or
process.pe.original_file_name in ("MSHTA.EXE", "RUNDLL32.EXE")) and
(
(process.command_line :
(
"*script*eval(*",
"*script*GetObject*",
"*.regread(*",
"*WScript.Shell*",
"*.run(*",
"*).Exec()*",
"*mshta*http*",
"*mshtml*RunHTMLApplication*",
"*mshtml*,#135*",
"*StrReverse*",
"*.RegWrite*",
/* Issue #379 */
"*window.close(*",
"* Chr(*"
)
/* FPs observed in telemetry */
and not process.parent.executable :
("?:\\Program Files (x86)\\Citrix\\System32\\wfshell.exe",
"?:\\Program Files (x86)\\Microsoft Office\\Office*\\MSACCESS.EXE",
"?:\\Program Files\\Quokka.Works GTInstaller\\GTInstaller.exe")
and not (process.name : "mshta.exe" and process.parent.name : "cscript.exe" and process.parent.command_line : "*GTInstaller.vbs*")
) or
/* Issue #379 */
(process.pe.original_file_name : "mshta.exe" and
not process.command_line : ("*.hta*", "*.htm*", "-Embedding") and process.args_count >=2) or
/* Execution of HTA file downloaded from the internet */
(process.pe.original_file_name : "mshta.exe" and process.command_line : "*\\Users\\*\\Downloads\\*.hta*") or
/* Execution of HTA file from archive */
(process.pe.original_file_name : "mshta.exe" and
process.args : ("?:\\Users\\*\\Temp\\7z*", "?:\\Users\\*\\Temp\\Rar$*", "?:\\Users\\*\\Temp\\Temp?_*", "?:\\Users\\*\\Temp\\BNZ.*")) or
/* Execution of HTA file from mounted ISO files */
(process.pe.original_file_name : "mshta.exe" and
process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe") and process.working_directory : "?:\\")
)
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_script_execution_via_msxsl.toml
+60
View File
@@ -0,0 +1,60 @@
[rule]
description = """
Identifies when a Windows Script module is loaded into the Microsoft Core XML Services (MSXML) process. This may
indicate an attempt to bypass application whitelisting by executing a malicious script in a trusted process.
"""
id = "de3615bc-4e50-485e-b3b5-8548ef6faa3d"
license = "Elastic License v2"
name = "Script Execution via MSXSL"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/"]
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and process.pe.original_file_name == "msxsl.exe"]
[library where dll.name : ("scrobj.dll", "jscript.dll", "vbscript.dll", "jscript9.dll")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1220"
name = "XSL Script Processing"
reference = "https://attack.mitre.org/techniques/T1220/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_scriptlet_execution_via_cmstp.toml
+65
View File
@@ -0,0 +1,65 @@
[rule]
description = """
Identifies when scrobj.dll is loaded into the Microsoft Connection Manager Profile Installer (cmstp.exe) process. This
may indicate an attempt to bypass application whitelisting by executing a malicious scriptlet in a trusted process.
"""
id = "8adfa9ad-0ed2-4b1b-bdad-f2c52e1d2a00"
license = "Elastic License v2"
name = "Scriptlet Execution via CMSTP"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Cmstp/"]
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and process.pe.original_file_name == "CMSTP.EXE"]
[library where dll.name : "scrobj.dll"]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.003"
name = "CMSTP"
reference = "https://attack.mitre.org/techniques/T1218/003/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_scriptlet_execution_via_rundll32.toml
+69
View File
@@ -0,0 +1,69 @@
[rule]
description = """
Identifies when scrobj.dll is loaded into rundll32.exe. An adversary may abuse rundll32.exe to proxy execution of
malicious code.
"""
id = "93438ae3-becd-43fa-81de-645ce17afa8e"
license = "Elastic License v2"
name = "Scriptlet Execution via Rundll32"
os_list = ["windows"]
reference = [
"https://lolbas-project.github.io/lolbas/Libraries/Ieadvpack/",
"https://lolbas-project.github.io/lolbas/Libraries/Advpack/",
]
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and process.pe.original_file_name == "RUNDLL32.EXE" and
process.command_line : "*advpack*LaunchINFSection*"]
[library where dll.name : "scrobj.dll"]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_scriptlet_proxy_execution_via_pubprn.toml
+66
View File
@@ -0,0 +1,66 @@
[rule]
description = """
Adversaries may use the trusted PubPrn script to proxy execution of malicious files. This behavior may bypass signature
validation restrictions and application control solutions that do not account for use of these scripts.
"""
id = "0d4454a7-c682-4085-995c-300973c5bdea"
license = "Elastic License v2"
name = "Scriptlet Proxy Execution via PubPrn"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Scripts/Pubprn/"]
version = "1.0.7"
query = '''
process where event.action == "start" and
process.pe.original_file_name in ("cscript.exe", "wscript.exe") and process.args_count >= 4 and
/* Issue 259 - additional rule strictness */
process.command_line : ("*localhost*script:http*", "*127.0.0.*script:http*")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1216"
name = "Signed Script Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1216/"
[[threat.technique.subtechnique]]
id = "T1216.001"
name = "PubPrn"
reference = "https://attack.mitre.org/techniques/T1216/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_solarmarker_backdoor_registry_modification.toml
+69
View File
@@ -0,0 +1,69 @@
[rule]
description = """
Identifies registry modification consistent with the SolarMarker Backdoor installer that registers a rogue custom shell
extension handler which runs a PowerShell command when a file with a matching extension is opened.
"""
id = "f7e6d239-9af5-42e3-8d23-91e7188a5cb0"
license = "Elastic License v2"
name = "SolarMarker Backdoor Registry Modification"
os_list = ["windows"]
reference = [
"https://blog.morphisec.com/new-jupyter-evasive-delivery-through-msi-installer",
"https://www.ired.team/offensive-security/persistence/hijacking-default-file-extension",
"https://www.binarydefense.com/mars-deimos-solarmarker-jupyter-infostealer-part-1/",
]
version = "1.0.4"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
process.name : ("reg.exe", "powershell.exe", "msiexec.exe")]
[registry where
registry.path : "HKEY_USERS\\S-1-5-21-*Classes\\*\\shell\\open\\command*" and
/* Command value contains PowerShell and its length is greater or equal than 200 chars */
registry.data.strings : "*PowerShell*" and length(registry.data.strings) >= 200]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[threat.technique.subtechnique]]
id = "T1546.001"
name = "Change Default File Association"
reference = "https://attack.mitre.org/techniques/T1546/001/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_suspicious_bitsadmin_activity.toml
+104
View File
@@ -0,0 +1,104 @@
[rule]
description = """
Identifies downloads, transfers, or job creations using Windows Background Intelligent Transfer Service (BITS) Admin
Tool. This tactic may be indicative of malicious activity where malware is downloading second stage payloads using
obscure methods.
"""
id = "676ac66c-4899-498f-ae21-ed5620af5477"
license = "Elastic License v2"
name = "Suspicious Bitsadmin Activity"
os_list = ["windows"]
reference = ["https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-2"]
version = "1.0.7"
query = '''
process where event.action == "start" and
(process.name : "bitsadmin.exe" or process.pe.original_file_name : "bitsadmin.exe") and
process.command_line : ("*download*", "*transfer*", "*create*", "*addfile*", "*SetNotifyCmdLine*") and
(process.parent.name : (
"winword.exe",
"excel.exe",
"outlook.exe",
"powerpnt.exe",
"eqnedt32.exe",
"fltldr.exe",
"mspub.exe",
"msaccess.exe",
"acrord32.exe",
"rdrcef.exe",
"foxitphantomPDF.exe",
"foxitreader.exe",
"firefox.exe",
"chrome.exe",
"iexplore.exe",
"opera.exe",
"plugin-container.exe",
"safari.exe",
"microsoftedge.exe",
"w3wp.exe",
"httpd.exe",
"nginx.exe",
"php.exe",
"php-cgi.exe",
"tomcat.exe",
"wscript.exe",
"cscript.exe",
"powershell.exe",
"pwsh.exe",
"cmd.exe"
) or
descendant of [process where event.action == "start" and
process.parent.name : (
"winword.exe",
"excel.exe",
"outlook.exe",
"powerpnt.exe",
"eqnedt32.exe",
"fltldr.exe",
"mspub.exe",
"msaccess.exe",
"acrord32.exe",
"rdrcef.exe",
"foxitphantomPDF.exe",
"foxitreader.exe",
"firefox.exe",
"chrome.exe",
"iexplore.exe",
"opera.exe",
"plugin-container.exe",
"safari.exe",
"microsoftedge.exe",
"w3wp.exe",
"httpd.exe",
"nginx.exe",
"php.exe",
"php-cgi.exe",
"tomcat.exe",
"wscript.exe",
"cscript.exe",
"powershell.exe",
"pwsh.exe",
"cmd.exe"
)])
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1197"
name = "BITS Jobs"
reference = "https://attack.mitre.org/techniques/T1197/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_suspicious_execution_from_a_mounted_device.toml
+88
View File
@@ -0,0 +1,88 @@
[rule]
description = """
Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may
use this technique to evade defenses.
"""
id = "42d2bbfb-a2fb-4327-b701-89ead6044ca1"
license = "Elastic License v2"
name = "Suspicious Execution from a Mounted Device"
os_list = ["windows"]
version = "1.0.9"
query = '''
sequence with maxspan=1m
[file where event.action == "creation" and file.extension : "lnk" and
process.name : "explorer.exe" and
file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.vhd.lnk",
"?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.iso.lnk")] by process.entity_id
[process where event.action == "start" and process.executable : "C:\\*" and
(process.working_directory : "?:\\" and not process.working_directory : "C:\\") and process.parent.name : "explorer.exe" and
process.name : ("rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "cmd.exe", "regsvr32.exe", "cscript.exe",
"wscript.exe", "wmic.exe", "msbuild.exe", "regsvcs.exe", "installutil.exe", "cmstp.exe", "msxsl.exe",
"Microsoft.Workflow.Compiler.exe", "wuauclt.exe") and
/* Issue #316 */
process.args_count >= 2] by process.parent.entity_id
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"
[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"
[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_suspicious_imageload_from_an_iso_mounted_device.toml
+53
View File
@@ -0,0 +1,53 @@
[rule]
description = """
Identifies instances of RunDLL32 or Regsvr32 loading a DLL from a mounted ISO device. Adversaries may deliver a
malicious payload via an ISO file and execute it via rundll32.exe or regsvr32.
"""
id = "779b9502-7912-4773-95a1-51cd702a71c8"
license = "Elastic License v2"
name = "Suspicious ImageLoad from an ISO Mounted Device"
os_list = ["windows"]
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
process.name : ("rundll32.exe", "regsvr32.exe") and
process.parent.name : ("cmd.exe", "explorer.exe", "powershell.exe", "winrar.exe", "7zFM.exe")]
[library where process.name : ("rundll32.exe", "regsvr32.exe") and
not dll.code_signature.trusted == true and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
/* loading dll from a mounted device */
(dll.path : "\\Device\\CdRom*" or dll.path regex """[d-zD-Z]:\\[0-9a-zA-Z\.]+""")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.16.0"
behavior/rules/defense_evasion_suspicious_imageload_via_windows_update_auto_update_client.toml
+49
View File
@@ -0,0 +1,49 @@
[rule]
description = """
Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used
as a defense evasion technique to blend-in malicious activity with legitimate Windows software.
"""
id = "3788c03d-28a5-4466-b157-d6dd4dc449bb"
license = "Elastic License v2"
name = "Suspicious ImageLoad via Windows Update Auto Update Client"
os_list = ["windows"]
reference = ["https://dtm.uk/wuauclt/"]
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
(process.pe.original_file_name == "wuauclt.exe" or process.name : "wuauclt.exe") and
process.parent.executable != null and
process.args : "/RunHandlerComServer" and process.args : "/UpdateDeploymentProvider" and
not process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\MoUsoCoreWorker.exe")]
[library where
not (dll.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation") and dll.code_signature.trusted == true) and
not (dll.code_signature.trusted == true and
dll.path : ("?:\\Program Files\\*.dll",
"?:\\Program Files (x86)\\*.dll",
"?:\\Windows\\System32\\*.dll",
"?:\\Windows\\SysWOW64\\*.dll",
"?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\*.dll"))]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.16.0"
behavior/rules/defense_evasion_suspicious_windows_defender_exclusions_added_via_powershell.toml
+88
View File
@@ -0,0 +1,88 @@
[rule]
description = """
Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder
directory or process level.
"""
id = "2ad8b514-baf0-4e29-a712-d6734868aa57"
license = "Elastic License v2"
name = "Suspicious Windows Defender Exclusions Added via PowerShell"
os_list = ["windows"]
reference = [
"https://docs.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2019-ps",
]
version = "1.0.4"
query = '''
sequence with maxspan=1m
[process where event.action == "start" and
not process.Ext.token.integrity_level_name == "system" and
(
(process.code_signature.trusted != true) or
(process.executable : ("?:\\Windows\\Microsoft.NET\\*",
"?:\\Users\\Public\\*",
"?:\\Users\\*\\AppData\\Local\\Temp\\*",
"?:\\Users\\*\\AppData\\Roaming\\*",
"?:\\Users\\*\\Pictures\\*",
"?:\\Users\\*\\Documents\\*",
"?:\\Windows\\Resources\\Themes\\*",
"?:\\ProgramData\\*") and not process.executable : "?:\\ProgramData\\*\\*") or
(process.name : ("rundll32.exe", "regsvr32.exe", "WScript.exe"))
)] by process.entity_id
[process where event.action == "start" and
process.name : ("cmd.exe", "powershell.exe") and
process.args : ("Add-MpPreference", "Set-MpPreference") and
process.args : ("-ExclusionPath", "-DisableRealtimeMonitoring", "-DisableScriptScanning", "-DisableArchiveScanning")] by process.parent.entity_id
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"
[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_suspicious_windows_lua_script_execution.toml
+44
View File
@@ -0,0 +1,44 @@
[rule]
description = """
Identifies the execution of Lua Windows Standalone Interpreter modules from suspicious locations. Attackers may abuse
Lua for Windows to execute malicious Lua script and bypass signature-based detection.
"""
id = "8f237d98-1825-4c27-a5cd-e38bde70882a"
license = "Elastic License v2"
name = "Suspicious Windows LUA Script Execution"
os_list = ["windows"]
version = "1.0.4"
query = '''
sequence by process.entity_id with maxspan=1m
[library where dll.name : ("luacom.dll", "lua?.?.dll") and not user.id : "S-1-5-18" and
not dll.code_signature.trusted == true and
dll.path : ("?:\\Programdata\\*", "?:\\Users\\*", "?:\\Windows\\Temp\\*", "?:\\windows\\System32\\Tasks\\*", "?:\\Windows\\Tasks\\*")]
[network where event.action == "connection_attempted"]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.003"
name = "Rename System Utilities"
reference = "https://attack.mitre.org/techniques/T1036/003/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.16.0"
behavior/rules/defense_evasion_suspicious_wmic_xsl_script_execution.toml
+65
View File
@@ -0,0 +1,65 @@
[rule]
description = """
Identifies Windows Management Instrumentation Command-Line utility (WMIC) whitelisting bypass attempts by alerting on
suspicious execution of scripts. When WMIC loads scripting libraries, it may be indicative of an attempt to bypass
application whitelisting
"""
id = "18371ec4-ee2f-465b-8757-ee726914006c"
license = "Elastic License v2"
name = "Suspicious WMIC XSL Script Execution"
os_list = ["windows"]
version = "1.0.8"
query = '''
sequence by process.entity_id with maxspan=2m
[process where event.action == "start" and
(process.name : "WMIC.exe" or process.pe.original_file_name : "wmic.exe") and
process.command_line : ("* format*:*", "*/format*:*", "*-format*:*") and
not process.command_line :
(
"*format:list*",
"*format:table*",
"*format:htable",
"*format:texttablewsys*",
"*format:texttable*",
"*format:textvaluelist*",
"*format:TEXTVALUELIST*",
"*format:csv*",
"*format:value*"
) and
not process.parent.executable : "?:\\Program Files\\Trend Micro\\Titanium\\plugin\\Pt\\win32\\inspect\\Inspect.exe"]
[library where dll.name : ("jscript.dll", "vbscript.dll")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1220"
name = "XSL Script Processing"
reference = "https://attack.mitre.org/techniques/T1220/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_unusual_dll_extension_loaded_by_rundll32_or_regsvr32.toml
+61
View File
@@ -0,0 +1,61 @@
[rule]
description = """
Identifies instances of RunDLL32 or Regsvr32 loading a DLL with an unusual file extension. Adversaries often abuse those
programs to proxy execution of malicious code.
"""
id = "76da5dca-ffe5-4756-85ba-3ac2e6ccf623"
license = "Elastic License v2"
name = "Unusual DLL Extension Loaded by Rundll32 or Regsvr32"
os_list = ["windows"]
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=1s
[process where event.action == "start" and process.name : ("rundll32.exe", "regsvr32.exe") and
not (process.parent.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\*\\BGHelper.exe" and
process.args : "ShowBatteryGauge" and process.args : "updatestatus") and
not (process.name : "regsvr32.exe" and process.args : "?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\BSPHelperObject.dll")
]
[library where process.name : ("rundll32.exe", "regsvr32.exe") and
not dll.name : ("*.dll", "*.cpl", "*.tmp", "*.exe", "*.tlb") and
not (dll.name : ("*.ocx", "*.ax") and process.name : "regsvr32.exe") and
not dll.code_signature.trusted == true and
not dll.path : ("?:\\Windows\\System32\\winspool.drv",
"?:\\Windows\\SysWOW64\\winspool.drv",
"?:\\Windows\\System32\\liunt.ime",
"?:\\Windows\\SysWOW64\\liunt.ime",
"?:\\Windows\\System32\\spool\\drivers\\*",
"?:\\Program Files (x86)\\*",
"?:\\Program Files\\*")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.16.0"
behavior/rules/defense_evasion_unusual_network_connection_via_rundll32.toml
+50
View File
@@ -0,0 +1,50 @@
[rule]
description = """
Identifies unusual instances of rundll32.exe making outbound network connections. This may be indicative of adversarial
command and control activity.
"""
id = "2e708541-c6e8-4ded-923f-78a6c160987e"
license = "Elastic License v2"
name = "Unusual Network Connection via RunDLL32"
os_list = ["windows"]
version = "1.0.8"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and process.name : "rundll32.exe" and process.args_count == 1 and
not (process.code_signature.subject_name == "Teramind Inc." and
process.code_signature.trusted == true and process.Ext.token.integrity_level_name == "system" and
process.args == "/update" and process.parent.name == "tmagentsvc.exe")]
[network where event.action == "connection_attempted" and process.name : "rundll32.exe"]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_windows_error_manager_reporting_masquerading.toml
+44
View File
@@ -0,0 +1,44 @@
[rule]
description = """
Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching
command-line and process executable values performing outgoing network connections. This may be indicative of a
masquerading attempt to evade suspicious child process behavior detections.
"""
id = "3d16f5f9-da4c-4b15-a501-505761b75ca6"
license = "Elastic License v2"
name = "Windows Error Manager/Reporting Masquerading"
os_list = ["windows"]
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
process.name : ("wermgr.exe", "WerFault.exe") and process.args_count == 1]
[network where event.action == "connection_attempted" and process.name : ("wermgr.exe", "WerFault.exe")]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/defense_evasion_windows_firewall_exception_list_modified_via_untrusted_process.toml
+55
View File
@@ -0,0 +1,55 @@
[rule]
description = """
Identifies the execution of the built-in Windows program, Netsh, to add a program to the Windows Firewall exception list
via an untrusted parent process.
"""
id = "5c01669c-e1cc-4acc-95b6-8b5e4a92c970"
license = "Elastic License v2"
name = "Windows Firewall Exception List Modified via Untrusted Process"
os_list = ["windows"]
reference = [
"https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior",
]
version = "1.0.8"
query = '''
sequence with maxspan=1m
[process where event.action == "start" and
process.executable : ("?:\\ProgramData\\*", "?:\\Users\\*", "?:\\Python*") and not process.code_signature.trusted == true] by process.entity_id
[process where event.action == "start" and process.name : "netsh.exe" and
process.command_line : "*add*allowedprogram*ENABLE*" and
not process.args : ("program=*:\\Program Files\\*", "program=*:\\Program Files (x86)\\*") and
not (process.args : "name=Free Download Manager" and process.parent.name : "fdm_x64_setup.tmp")
] by process.parent.entity_id
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.004"
name = "Disable or Modify System Firewall"
reference = "https://attack.mitre.org/techniques/T1562/004/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/discovery_external_ip_address_discovery_via_a_trusted_program.toml
+84
View File
@@ -0,0 +1,84 @@
[rule]
description = """
Identifies scripting utilities and commonly abused binary proxy programs making a DNS request to a known public IP
address lookup web service. Malwares tend to perform this action to assess potential targets.
"""
id = "51894221-7657-4b56-9406-e080e19ad159"
license = "Elastic License v2"
name = "External IP Address Discovery via a Trusted Program"
os_list = ["windows"]
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and user.id : "S-1-5-21-*" and
(
process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
"powershell.exe", "pwsh.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe",
"installutil.exe","RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe") or
process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
"?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
"?:\\Windows\\Microsoft.NET\\*.exe")
)
]
[dns where
dns.question.name :
(
"ip-api.com",
"checkip.dyndns.org",
"api.ipify.org",
"api.ipify.com",
"whatismyip.akamai.com",
"bot.whatismyipaddress.com",
"ifcfg.me",
"ident.me",
"ipof.in",
"ip.tyk.nu",
"icanhazip.com",
"curlmyip.com",
"wgetip.com",
"eth0.me",
"ipecho.net",
"ip.appspot.com",
"api.myip.com",
"geoiptool.com",
"api.2ip.ua",
"api.ip.sb",
"ipinfo.io",
"checkip.amazonaws.com",
"wtfismyip.com",
"iplogger.org",
"freegeoip.net",
"freegeoip.app",
"ipinfo.io",
"geoplugin.net",
"myip.dnsomatic.com",
"www.geoplugin.net",
"api64.ipify.org",
"ip4.seeip.org",
"*.geojs.io",
"*portmap.io"
)
]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1016"
name = "System Network Configuration Discovery"
reference = "https://attack.mitre.org/techniques/T1016/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/discovery_external_ip_address_discovery_via_untrusted_program.toml
+78
View File
@@ -0,0 +1,78 @@
[rule]
description = """
Identifies a dropped unsigned program making a DNS request to a known public IP address lookup web service. Malwares
tend to perform this action to assess potential targets.
"""
id = "dfe28e03-9b0b-47f5-9753-65ed2666663f"
license = "Elastic License v2"
name = "External IP Address Discovery via Untrusted Program"
os_list = ["windows"]
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=1m
/* execution of an unsigned PE file followed by dns request to public ip discovery web services */
[process where event.action == "start" and user.id : "S-1-5-21-*" and
not process.code_signature.trusted == true and
process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*")]
[dns where
dns.question.name :
(
"ip-api.com",
"checkip.dyndns.org",
"api.ipify.org",
"whatismyip.akamai.com",
"bot.whatismyipaddress.com",
"ifcfg.me",
"ident.me",
"ipof.in",
"ip.tyk.nu",
"icanhazip.com",
"curlmyip.com",
"wgetip.com",
"eth0.me",
"ipecho.net",
"ip.appspot.com",
"api.myip.com",
"geoiptool.com",
"api.2ip.ua",
"api.ip.sb",
"ipinfo.io",
"checkip.amazonaws.com",
"wtfismyip.com",
"iplogger.org",
"freegeoip.net",
"freegeoip.app",
"ipinfo.io",
"geoplugin.net",
"myip.dnsomatic.com",
"www.geoplugin.net",
"api64.ipify.org",
"ip4.seeip.org",
"*.geojs.io",
"*portmap.io"
)]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1016"
name = "System Network Configuration Discovery"
reference = "https://attack.mitre.org/techniques/T1016/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/discovery_potential_security_software_discovery_via_grep.toml
+48
View File
@@ -0,0 +1,48 @@
[rule]
description = """
Identifies the use of the grep command to discover known third-party macOS and Linux security tools, such as Antivirus
or Host Firewall details.
"""
id = "13eade2e-73dd-4fab-a511-88258635559d"
license = "Elastic License v2"
name = "Potential Security Software Discovery via Grep"
os_list = ["linux", "macos"]
reference = ["https://objective-see.com/blog/blog_0x4F.html"]
version = "1.0.6"
query = '''
process where event.type == "start" and
process.name : ("grep", "egrep", "sh") and user.id != 0 and
process.command_line : "*grep*Little Snitch*" and not process.parent.executable : "/Library/Application Support/*"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1518"
name = "Software Discovery"
reference = "https://attack.mitre.org/techniques/T1518/"
[[threat.technique.subtechnique]]
id = "T1518.001"
name = "Security Software Discovery"
reference = "https://attack.mitre.org/techniques/T1518/001/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/discovery_potential_virtual_machine_fingerprinting_via_grep.toml
+54
View File
@@ -0,0 +1,54 @@
[rule]
description = """
An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies
common locations used to discover virtual machine hardware by a non-root user.
"""
id = "e5c0963c-0367-4d24-bdf2-5af3a233e57b"
license = "Elastic License v2"
name = "Potential Virtual Machine Fingerprinting via Grep"
os_list = ["macos"]
reference = ["https://objective-see.com/blog/blog_0x4F.html"]
version = "1.0.5"
query = '''
process where event.type == "start" and
process.name in ("grep", "egrep") and user.id != 0 and
process.command_line : ("*parallels*", "*vmware*", "*virtualbox*") and process.command_line : "*Manufacturer*" and
not process.parent.executable in ("/Applications/Docker.app/Contents/MacOS/Docker", "/usr/libexec/kcare/virt-what")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"
[[threat.technique]]
id = "T1497"
name = "Virtualization/Sandbox Evasion"
reference = "https://attack.mitre.org/techniques/T1497/"
[[threat.technique.subtechnique]]
id = "T1497.001"
name = "System Checks"
reference = "https://attack.mitre.org/techniques/T1497/001/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/execution_command_shell_activity_started_via_rundll32.toml
+69
View File
@@ -0,0 +1,69 @@
[rule]
description = "Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code."
id = "b8a0a3aa-0345-4035-b41d-f758a6c59a78"
license = "Elastic License v2"
name = "Command Shell Activity Started via RunDLL32"
os_list = ["windows"]
version = "1.0.5"
query = '''
process where event.type == "start" and
process.name : ("cmd.exe", "powershell.exe") and
process.parent.name : "rundll32.exe" and process.parent.command_line != null and
not process.parent.command_line :
("*:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL*",
"*zzzzInvokeManagedCustomActionOutOfProc*") and
not (process.parent.args : "aepdu.dll,AePduRunUpdate" and process.args : "osloader" and process.args : "%windir%\\system32\\bcdedit") and
not (process.parent.args : ("?:\\Windows\\System32\\LogiLDA.dll,LogiFetch", "?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask") and
process.name : "powershell.exe" and process.command_line : "*install*") and
not (process.args : "dellpointstick://Mainpage/*" and process.parent.args : "Vxd_launch_UI") and
not (process.parent.args : "?:\\Windows\\system32\\davclnt.dll,DavSetCookie" and process.name : "powershell.exe") and
not process.parent.args : "AppXDeploymentExtensions.OneCore.dll,ShellRefresh" and
not (process.args : ("launchalpsdelltouchpad://Mainpage/path2?param=start", "alpsdelltouchpadsettings://Mainpage/path2?param=start") and
process.parent.args : "?:\\WINDOWS\\System32\\main.cpl") and
not (process.command_line : "*REG QUERY HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography*" and
process.parent.args : "?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask")
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/execution_delayed_execution_via_ping.toml
+128
View File
@@ -0,0 +1,128 @@
[rule]
description = """
Identifies the execution of commonly abused Windows utilities via a delayed Ping execution. This behavior is often
observed during malware installation and is consistent with an attacker attempting to evade detection.
"""
id = "7615ca4b-c291-4f05-9488-114b6bf99157"
license = "Elastic License v2"
name = "Delayed Execution via Ping"
os_list = ["windows"]
version = "1.0.5"
query = '''
sequence by process.parent.entity_id with maxspan=1m
[process where event.action == "start" and process.name : "ping.exe" and
process.parent.name : "cmd.exe" and not user.id : "S-1-5-18" and
process.args : "-n" and
process.args : ("8.8.*", "localhost", "127.*", "0.0.*.*")]
[process where event.action == "start" and
process.parent.name : "cmd.exe" and
process.name : ("rundll32.exe",
"powershell.exe",
"mshta.exe",
"msbuild.exe",
"certutil.exe",
"regsvr32.exe",
"powershell.exe",
"cscript.exe",
"wscript.exe",
"wmic.exe",
"installutil.exe",
"msxsl.exe",
"Microsoft.Workflow.Compiler.exe",
"ieexec.exe",
"iexpress.exe",
"RegAsm.exe",
"installutil.exe",
"RegSvcs.exe",
"RegAsm.exe") or
(process.executable : "?:\\Users\\*\\AppData\\*.exe" and not process.code_signature.trusted == true) and
not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
not (process.name : ("openssl.exe", "httpcfg.exe", "certutil.exe") and process.parent.command_line : "*ScreenConnectConfigurator.cmd*") and
not (process.pe.original_file_name : "DPInst.exe" and process.command_line : "driver\\DPInst_x64 /f ") and
not (process.name : "powershell.exe" and process.args : "Write-Host ======*")
]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1216"
name = "Signed Script Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1216/"
[[threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.003"
name = "CMSTP"
reference = "https://attack.mitre.org/techniques/T1218/003/"
[[threat.technique.subtechnique]]
id = "T1218.004"
name = "InstallUtil"
reference = "https://attack.mitre.org/techniques/T1218/004/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"
[[threat.technique.subtechnique]]
id = "T1218.009"
name = "Regsvcs/Regasm"
reference = "https://attack.mitre.org/techniques/T1218/009/"
[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"
[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"
[[threat.technique]]
id = "T1220"
name = "XSL Script Processing"
reference = "https://attack.mitre.org/techniques/T1220/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/execution_download_and_execution_of_javascript_payload.toml
+56
View File
@@ -0,0 +1,56 @@
[rule]
description = """
Identifies when curl is used to download a JavaScript payload and subsequently execute it using the built-in osascript
utility. An adversary may use this technique to execute their malicious payload and obtain initial access to an
endpoint.
"""
id = "871f0c30-a7c5-40a5-80e3-a50c6714632f"
license = "Elastic License v2"
name = "Download and Execution of JavaScript Payload"
os_list = ["macos"]
reference = ["https://github.com/its-a-feature/Mythic"]
version = "1.0.8"
query = '''
sequence by user.id with maxspan=30s
[process where event.action == "exec" and
process.name : "curl" and process.args : "http*" and
not process.args : ("https://*.jamfcloud.com/JSSResource/*",
"https://download.zerotier.com/RELEASES/*",
"https://download.mozilla.org/?os=osx&product=firefox-latest-ssl")]
[process where event.action == "exec" and process.name : "osascript" and
process.command_line : "*-l JavaScript*" and
/* rule scope is limited to curl output passed to osascript via pipe */
process.args_count <= 3]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/execution_dynwrapx_image_load_via_windows_scripts.toml
+52
View File
@@ -0,0 +1,52 @@
[rule]
description = """
Identifies when a Windows script interpreter loads an external library that allow to call Windows API functions from
scripts in JScript and VBScript. Malware may abuse this legit capability to interact further with the Operating System.
"""
id = "4cd6f758-0057-4e8a-9701-20b6116c2118"
license = "Elastic License v2"
name = "Dynwrapx Image Load via Windows Scripts"
os_list = ["windows"]
reference = [
"https://www.script-coding.com/dynwrapx_eng.html",
"https://www.splunk.com/en_us/blog/security/detecting-malware-script-loaders-using-remcos-threat-research-release-december-2021.html",
]
version = "1.0.4"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.type == "start" and
process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe")]
[library where dll.pe.original_file_name : "dynwrapx.dll"]
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/execution_eggshell_backdoor_execution.toml
+39
View File
@@ -0,0 +1,39 @@
[rule]
description = "Identifies the execution of the EggShell backdoor. EggShell is a known post exploitation tool for macOS and Linux."
id = "feed7842-34a6-4764-b858-6e5ac01a5ab7"
license = "Elastic License v2"
name = "EggShell Backdoor Execution"
os_list = ["linux", "macos"]
reference = ["https://github.com/neoneggplant/EggShell"]
version = "1.0.9"
query = '''
process where event.action == "exec" and
process.executable : ("/private/tmp/*", "/tmp/*") and process.args : "eyJkZWJ1ZyI6*"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/execution_embedded_executable_via_windows_shortcut_file.toml
+89
View File
@@ -0,0 +1,89 @@
[rule]
description = """
Identifies the execution of a an executable extracted from within a Windows shortcut (lnk) file. Adversaries may embed
malicious files in a shortcut file before delivering it to their target in order to trick them into executing the
payload.
"""
id = "9fdd772b-b483-404f-bc02-7ec87e332bec"
license = "Elastic License v2"
name = "Embedded Executable via Windows Shortcut File"
os_list = ["windows"]
reference = ["https://www.x86matthew.com/view_post?id=embed_exe_lnk"]
version = "1.0.4"
query = '''
sequence with maxspan=1m
[ file where event.action != "deletion" and
(file.Ext.header_bytes : "4d5a*" or file.extension : ("exe", "scr", "pif", "com")) and
process.name : ("cmd.exe", "powershell.exe") ] by process.entity_id
[ process where event.action == "start" and
process.parent.name : ("cmd.exe", "powershell.exe") and process.parent.command_line : "*.lnk*"] by process.parent.entity_id
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"
[[threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"
[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"
[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.001"
name = "Malicious Link"
reference = "https://attack.mitre.org/techniques/T1204/001/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/execution_empire_stager_execution.toml
+65
View File
@@ -0,0 +1,65 @@
[rule]
description = """
Identifies when a script interpreter executes a base64-encoded Empire stager. Empire is penetration testing software
that is often utilized by attackers.
"""
id = "b7974ff6-82ff-4743-9e07-1c6901b1f0ea"
license = "Elastic License v2"
name = "Empire Stager Execution"
os_list = ["linux", "macos"]
reference = ["https://github.com/EmpireProject/Empire", "https://github.com/BC-SECURITY/Empire"]
version = "1.0.7"
query = '''
process where event.action == "exec" and
process.name : ("python*", "osascript", "sh", "bash", "dash", "ksh", "tcsh", "zsh") and
process.command_line : "*exec(base64.b64decode*aW1wb3J0IHN5cztpbXBvcnQg*"
'''
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1132"
name = "Data Encoding"
reference = "https://attack.mitre.org/techniques/T1132/"
[[threat.technique.subtechnique]]
id = "T1132.001"
name = "Standard Encoding"
reference = "https://attack.mitre.org/techniques/T1132/001/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"

Some files were not shown because too many files have changed in this diff Show More