admin/elastic-protections-artifacts
1
0
Fork 0
mirror of https://github.com/elastic/protections-artifacts synced 2026-06-08 14:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updating artifacts

Browse Source
This commit is contained in:
protectionsmachine
2026-03-25 10:09:50 +00:00
parent 1f3f563a9e
commit afbae585d8
42 changed files with 398 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
behavior/rules/cross-platform/privilege_escalation_suspicious_privileged_docker_execution.toml
+3 -2
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Suspicious Privileged Docker Execution"
os_list = ["linux", "macos"]
reference = ["https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack"]
version = "1.0.4"
version = "1.0.5"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "docker" and
@@ -19,7 +19,8 @@ not (
(process.args == "prepare" and process.args in ("/:/hostfs", "/:/hostfs/")) or
(process.args == "aktosecurity/mirror-api-logging:k8s_ebpf" and process.args == "akto-api-security-traffic-collector") or
(process.args == "/usr/sbin/ceph-volume" and process.args == "--group-add=disk" and process.args == "--stop-signal=SIGTERM") or
(process.args like "eu.gcr.io/revolut-labs/cardfinder*" and process.parent.args == "/srv/cardfinder/cardfinder.sh")
(process.args like "eu.gcr.io/revolut-labs/cardfinder*" and process.parent.args == "/srv/cardfinder/cardfinder.sh") or
process.parent.args == "/usr/local/pf/sbin/netdata-docker-wrapper"
)
'''
behavior/rules/linux/command_and_control_file_download_from_or_upload_to_hosting_service.toml
+2 -2
View File
@@ -7,7 +7,7 @@ id = "5c18132a-e279-404e-a8d8-922546d469a7"
license = "Elastic License v2"
name = "File Download from or Upload to Hosting Service"
os_list = ["linux"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("curl", "wget") and
@@ -15,7 +15,7 @@ process.command_line like~ (
"*pastebin.*", "*ghostbin.*", "*hastebin.*", "*termbin.*", "*dpaste.*", "*controlc.*", "*0bin.net*", "*p.ip.fi*", "*sprunge.us*", "*paste.ee*",
"*paste.ofcode.org*", "*textbin.net*", "*transfer.sh*", "*anonfiles.*", "*easyupload.io*", "*gofile.io*", "*send.cm*", "*ufile.io*",
"*pixeldrain.com*", "*bayfiles.*", "*megaupload.*", "*mediafire.*", "*zippyshare.com*", "*dropapk.to*", "*shorturl.at*", "*tinyurl.com*",
"*bit.ly/*", "*cutt.ly/*", "*is.gd/*", "*rebrand.ly/*", "*adf.ly/*", "*rb.gy/*", "*bashupload.com/*", "*bujang.online/*"
"*bit.ly/*", "*cutt.ly/*", "*is.gd/*", "*rebrand.ly/*", "*adf.ly/*", "*rb.gy/*", "*bashupload.com/*", "*bujang.online/*", "*paste.wakas.org*"
) and not (
process.parent.executable in ("/opt/aws/awsagent/bin/update", "/batch/pac.liste.categorie.sh") or
process.parent.args == "/usr/local/gg/crowdsec-extract.sh"
behavior/rules/linux/command_and_control_hidden_executable_initiated_egress_network_connection.toml
+3 -2
View File
@@ -7,12 +7,13 @@ id = "c14705f7-ebd3-4cf7-88b3-6bff2d832f1b"
license = "Elastic License v2"
name = "Hidden Executable Initiated Egress Network Connection"
os_list = ["linux"]
version = "1.0.4"
version = "1.0.5"
query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name like ".*" and
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"]
process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*" and
not process.executable like "/home/*/.npm/_npx/*/node_modules/opencode-ai/bin/.opencode"]
[network where event.type == "start" and event.action == "connection_attempted" and not (
destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
behavior/rules/linux/defense_evasion_potential_process_masquerading_via_exec.toml
+6 -2
View File
@@ -8,7 +8,7 @@ id = "e6669bc3-cb75-4fb3-91e0-ddaa06dd59b2"
license = "Elastic License v2"
name = "Potential Process Masquerading via Exec"
os_list = ["linux"]
version = "1.0.13"
version = "1.0.15"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
@@ -20,6 +20,9 @@ process.args == "-c" and process.command_line : "* exec -a *" and not (
"/usr/NX/bin/nxnode.bin", "/usr/bin/gnome-shell", "/var/lib/dpkg/info/udev.postinst", "/usr/bin/bcompare",
"/usr/bin/su"
) or
process.parent.executable like ("/home/*/.local/share/claude/*", "/home/*/.local/bin/klaude") or
process.parent.args == "claude" or
process.parent.name == "claude" or
process.command_line like (
"*/tmp/fzf-args*", "/opt/sp/serverpilot/*", "*/opt/forticlientems/*", "*WarpTerminal*", "/bin/bash -c exec -a bash*",
"/bin/bash -c exec -a sp-agent /opt/sp/serverpilot/agent/bin/sp-agent", """bash -c exec -a "$0" "$@" reboot /usr/sbin/reboot.no-molly-guard""",
@@ -31,7 +34,8 @@ process.args == "-c" and process.command_line : "* exec -a *" and not (
"exec -a sp-monitor /opt/sp/serverpilot/monitor/bin/monitor",
"exec -a sp-stats /opt/sp/serverpilot/stats/bin/sp-stats",
"/usr/bin/bcompare", "/usr/lib64/beyondcompare/BCompare"
)
) or
process.parent.command_line == "runc init"
)
'''
behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml
+2 -2
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Shared Object Injection via Process Environment Variable"
os_list = ["linux"]
reference = ["https://attack.mitre.org/techniques/T1574/006/"]
version = "1.0.45"
version = "1.0.46"
query = '''
process where event.type == "start" and event.action == "exec" and process.env_vars like "LD_PRELOAD=?*" and
@@ -57,7 +57,7 @@ process where event.type == "start" and event.action == "exec" and process.env_v
"LD_PRELOAD=/usr/lib/libjemalloc.so.2:/opt/zlib-ng/lib/libz.so",
"LD_PRELOAD=/lib/x86_64-linux-gnu/libSegFault.so", "LD_PRELOAD=/usr/lib/libnss_wrapper.so",
"LD_PRELOAD=/tmp/*/openwrt-imagebuilder*/runas.so", "LD_PRELOAD=/tmp/pressure-vessel-libs-*/libMangoHud_shim.so",
"LD_PRELOAD=/home/libjemalloc.so.2"
"LD_PRELOAD=/home/libjemalloc.so.2", "LD_PRELOAD=/tmp/libredirectnull.so", "LD_PRELOAD=/tmp/libcuda_trace.so"
) or
(process.env_vars == "LD_PRELOAD=./getrandom.so" and process.parent.command_line == "/opt/perlbrew/perls/perl-5.40.3/bin/perl t/getrandom.t") or
process.parent.command_line == "runc init" or
behavior/rules/linux/execution_javascript_execution_via_deno_on_linux.toml
+50
View File
@@ -0,0 +1,50 @@
[rule]
description = """
Identifies attempts to execute JavaScript using Deno with suspicious command line value. Adversaries may abuse this
utility to execute malicious JavaScript.
"""
id = "9c78eda8-68e7-49a8-87d2-5364381ba624"
license = "Elastic License v2"
name = "JavaScript Execution via Deno on Linux"
os_list = ["linux"]
reference = ["https://deno.com/"]
version = "1.0.0"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "deno" and
process.command_line like~ ("*base64*", "*eval(*", "*http*", "*javascript*import*") and
not process.command_line == "deno run --allow-all --quiet --no-config https://deno.land/x/wmill/main.ts completions zsh"
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
+3 -2
View File
@@ -8,7 +8,7 @@ id = "aa02591f-c9e6-4317-841e-0b075b9515ff"
license = "Elastic License v2"
name = "Linux Suspicious Child Process Execution via Interactive Shell"
os_list = ["linux"]
version = "1.0.19"
version = "1.0.20"
query = '''
process where event.type == "start" and event.action == "exec" and process.args in ("-i", "-il", "-li") and process.args_count <= 2 and
@@ -35,7 +35,8 @@ process.parent.name like (
"/mnt/*/.vscode-server/bin/*/node", "/vscode/vscode-server/bin/*/node", "/home/*/.vscode-server/bin/*/node",
"/usr/scratch/*/.vscode-server/bin/*/node", "/home/*/.vscode-server/*/server/node", "/scratch/user/*/.vscode-server/cli/servers/*/server/node",
"/home/*/.vscode/cli/servers/*/server/node", "/root/.vscode-server/cli/servers/*/server/node", "/mnt/*/.vscode-server/cli/servers/*/server/node",
"/home/*/.antigravity-server/bin/*/node", "/user/*/.trae-server/bin/*/node"
"/home/*/.antigravity-server/bin/*/node", "/user/*/.trae-server/bin/*/node", "/var/lib/docker/overlay2/*/merged/vscode/vscode-server/bin/linux-x64/*/node",
"/home/*/miniforge3/envs/*/bin/python*"
) or
(process.parent.command_line like ("*pipenv*", "*poetry*") and process.parent.args:"shell")
)
behavior/rules/linux/execution_potential_reverse_shell_via_named_pipe.toml
+2 -2
View File
@@ -7,7 +7,7 @@ id = "40bec6eb-e93b-4d09-8265-66bba186e332"
license = "Elastic License v2"
name = "Potential Reverse Shell via Named Pipe"
os_list = ["linux"]
version = "1.0.15"
version = "1.0.16"
query = '''
process where event.type == "start" and event.action == "exec" and
@@ -21,7 +21,7 @@ process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish
process.parent.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}.*"
)
) and
not (process.name == "mknod" and process.args like ("/var/tmp/dracut*", "/tmp/dracut.*", "/var/tmp/portage/*", "/tmp/dib_build*"))
not (process.name == "mknod" and process.args like ("/var/tmp/dracut*", "/tmp/dracut.*", "/var/tmp/portage/*", "/tmp/dib_build*", "/tmp/bootstrap-salt.logpipe"))
'''
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_sleep_execution_from_suspicious_process_path.toml
+3 -3
View File
@@ -7,7 +7,7 @@ id = "9e879677-2317-4c1d-bddb-8fa4629be810"
license = "Elastic License v2"
name = "Sleep Execution from Suspicious Process Path"
os_list = ["linux"]
version = "1.0.13"
version = "1.0.14"
query = '''
sequence by process.parent.entity_id with maxspan=5s
@@ -21,7 +21,7 @@ sequence by process.parent.entity_id with maxspan=5s
"/tmp/*/.venv/bin/python", "/tmp/text_templater_*", "/var/tmp/container*/usr/bin/dpkg", "/tmp/container*/usr/bin/dpkg",
"/run/systemd/mount-rootfs/nix/store/*", "/tmp/xfs-*/yarn", "/tmp/root/spack*", "/tmp/nix-shell-*/node",
"/tmp/nix-shell-*/yarn", "/var/tmp/portage/*", "/tmp/.*.ansible/ansible-tmp-*", "/tmp/nsjail.1000.root/usr/bin/sleep",
"/tmp/usr/bin/*", "/tmp/build/.heroku/node/bin/npm", "/tmp/petalinux/*", "/tmp/tailsampling-*"
"/tmp/usr/bin/*", "/tmp/build/.heroku/node/bin/npm", "/tmp/petalinux/*", "/tmp/tailsampling-*", "/tmp/*/.cursor-server/bin/linux-x64/*/node"
) or
process.command_line == "runc init" or
process.name in ("gcc", "xgcc", "nvim") or
@@ -32,7 +32,7 @@ sequence by process.parent.entity_id with maxspan=5s
) or
process.parent.executable like (
"/tmp/go-build*", "/tmp/newroot/tmp/.mount*", "/var/lib/containers/*", "/tmp/newroot/usr/bin/ansible-playbook",
"/usr/bin/ansible-playbook"
"/usr/bin/ansible-playbook", "/tmp/newroot/*", "/tmp/.mount_cursor*/cursorsandbox"
) or
process.parent.args like "source /home/*/.claude/shell-snapshots/snapshot-bash*" or
process.parent.command_line like "*github.com/community-scripts/ProxmoxVE/*" or
behavior/rules/linux/execution_suspicious_perl_command_execution.toml
+5 -2
View File
@@ -8,7 +8,7 @@ id = "13c404cb-7631-4a33-8b59-5545e9a8a598"
license = "Elastic License v2"
name = "Suspicious Perl Command Execution"
os_list = ["linux"]
version = "1.0.11"
version = "1.0.12"
query = '''
process where event.type == "start" and event.action == "exec" and
@@ -20,7 +20,10 @@ process.args == "-e" and process.command_line like~ (
"*Marshal.load(*", "*Fiddle.dlopen(*", "*Fiddle::Function.new(*", "*base64*", "*zlib*",
"*net/http*", "*socket.new*", "*open-uri*", "*pack(*"
) and not (
process.working_directory like~ ("/builds/*", "/root/.perl-cpm/*/MIME-tools-*", "/root/.cpan*", "/scratch/*") or
process.working_directory like~ (
"/builds/*", "/root/.perl-cpm/*/MIME-tools-*", "/root/.cpan*", "/scratch/*", "/emulator/snmpAgent/net-snmp*",
"/data1/Axway/TSIM/is/instances/*", "/build/linux-x86_64/__build__/__vmbuild__"
) or
process.command_line like (
"perl -e eval { use MIME::Base64; print 1; }", "/home/*/bin/sendEmail*", "*transfer fish server*",
"""perl -e $|=1; print "### 100 transfer fish server\n"; while(<STDIN>) { last if /^__END__/; $code.=$_; } exit(eval($code))""",
behavior/rules/linux/execution_suspicious_python_command_execution.toml
+3 -2
View File
@@ -8,7 +8,7 @@ id = "028d01ae-bfbf-438e-a0d0-23aee55ea5c9"
license = "Elastic License v2"
name = "Suspicious Python Command Execution"
os_list = ["linux"]
version = "1.0.16"
version = "1.0.17"
query = '''
process where event.type == "start" and event.action == "exec" and process.name like "python*" and
@@ -50,7 +50,8 @@ process.args == "-c" and (
"python3 -c import socket; s=socket.socket(); s.bind(('0.0.0.0', 0)); print(s.getsockname()[1]); s.close()",
"python3 -c import socket; s=socket.socket(); s.bind(('localhost', 0)); print(s.getsockname()[1]); s.close()",
"import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*",
"*Thomas Nagy*"
"*Thomas Nagy*",
"/usr/bin/python* -c import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
) or
process.parent.executable like~ (
"/var/lib/amazon/ssm/*", "/var/anaconda3/envs/*", "/tmp/plz_sandbox/test", "/usr/bin/cockpit-bridge",
behavior/rules/linux/lateral_movement_potential_netcat_file_listener_established.toml
+5 -2
View File
@@ -7,7 +7,7 @@ id = "b3ab4040-1289-4a8a-959a-bb71c9b09afe"
license = "Elastic License v2"
name = "Potential Netcat File Listener Established"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
sequence by process.entity_id with maxspan=5s
@@ -16,7 +16,10 @@ sequence by process.entity_id with maxspan=5s
)]
[process where event.type == "start" and event.action == "exec" and
process.name in ("nc","ncat","netcat","netcat.openbsd","netcat.traditional") and
not process.command_line like ("*127.0.0.1*", "*localhost*", "-*z*")]
not (
process.command_line like ("*127.0.0.1*", "*localhost*") or
process.args like "-*z*"
)]
'''
min_endpoint_version = "7.15.0"
behavior/rules/linux/persistence_egress_network_connection_from_rpm_package.toml
+2 -1
View File
@@ -7,7 +7,7 @@ id = "d20cd4ba-ff65-4e1c-8012-4241d449b16b"
license = "Elastic License v2"
name = "Egress Network Connection from RPM Package"
os_list = ["linux"]
version = "1.0.11"
version = "1.0.12"
query = '''
sequence with maxspan=3s
@@ -24,6 +24,7 @@ sequence with maxspan=3s
)
) or
(process.name == "curl" and process.args == "sudo" and process.args == "mdatp" and process.args == "--cacert") or
process.command_line like "runuser -u mdatp*" or
process.name == "sudo"
)
] by process.entity_id
behavior/rules/linux/persistence_scheduled_task_unusual_command_execution.toml
+3 -2
View File
@@ -12,7 +12,7 @@ reference = [
"https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
"https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
]
version = "1.0.16"
version = "1.0.17"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name in ("systemd", "cron", "crond") and
@@ -49,7 +49,8 @@ not (
"sudo curl*raw.githubusercontent.com/*/backup-scripts/refs/heads/main/fortigate-backup.sh*",
"/usr/bin/curl -s -H*zendesk.com/api/v2/ticket_metrics.json*",
"wget --proxy=off*cat*batch_trigger.log",
"export PM2_HOME=*"
"export PM2_HOME=*",
"/usr/bin/curl*/var/log/checkdiskusage.log", "ps*/opt/fortinet/fortisiem/linux-agent/tmp/*"
) or
process.working_directory like "/opt/nessus_agent/*"
)
behavior/rules/linux/persistence_suspicious_echo_execution.toml
+8 -3
View File
@@ -9,7 +9,7 @@ id = "a13c8f01-36a5-4ad7-a282-8d297cf62860"
license = "Elastic License v2"
name = "Suspicious Echo Execution"
os_list = ["linux"]
version = "1.0.27"
version = "1.0.28"
query = '''
process where event.type == "start" and event.action == "exec" and
@@ -68,7 +68,11 @@ not (
"/bin/rphcp", "/u1/grid/*/perl/bin/perl", "/home/*/.vscode-oss/extensions/openai.chatgp*universal/bin/linux-x86_64/codex",
"/opt/teleport/system/bin/teleport", "/opt/claude-code/bin/claude", "/usr/cachesys/bin/cache", "/usr/bin/sway", "/usr/bin/runc",
"/usr/bin/sw-engine", "/opt/nvidia/sdkmanager/sdkmanager-gui", "/usr/bin/claude-bin", "/home/*/.vscode-server/*/codex",
"/usr/bin/mawk", "/mnt/ssd/wda/tools/nuctl/nuctl-*-linux-amd64"
"/usr/bin/mawk", "/mnt/ssd/wda/tools/nuctl/nuctl-*-linux-amd64", "/home/*/.local/share/uv/python/*/bin/python*", "/usr/sbin/qemu-ga",
"/usr/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex",
"/user/*/.vscode-server/*/claude", "/home/*/.nvm/versions/node/*/codex", "/scratch/user/*/npm-global/lib/node_modules/*/codex",
"/snap/docker/*/bin/runc", "/usr/local/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex",
"/usr/share/windsurf/resources/app/extensions/windsurf/bin/language_server_linux_x64"
) or
process.parent.command_line in (
"runc init", "buildkit-runc init", "/usr/local/bin/runc init", "python ./ssh.py --update-fingerprints bi_team",
@@ -105,7 +109,8 @@ not (
process.parent.args like (
"/nix/store/*", "/usr/bin/swatchdog*", "/usr/local/hostguard/data/benchmark/module/SSH/playbook.py",
"/tmp/kubectl*.yaml", "./mmicro-control.pl", "/usr/local/bin/vncserver", "buildah-chroot-exec", "/usr/libexec/crio/crun",
"/usr/bin/crun", "/usr/bin/vncserver", "/tmp/ansible_*/ansible_module_command.py", "/opt/calculus/farmer/app/farmer.py"
"/usr/bin/crun", "/usr/bin/vncserver", "/tmp/ansible_*/ansible_module_command.py", "/opt/calculus/farmer/app/farmer.py",
"openclaw-gateway", "lxc-attach", "/home/*/.npm-global/lib/node_modules/openclaw/dist/index.js"
) or
process.working_directory like ("/var/local/InterMapper_Settings/Tools", "/usr/local/gateway-*", "/repo/o11y/out/*/.terraform/*") or
(process.working_directory == "/etc/prometheus" and process.parent.command_line == "tmux -Lwarp -CC") or
behavior/rules/windows/command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml
+2 -2
View File
@@ -7,11 +7,11 @@ id = "fb6939a2-1b54-428c-92a2-3a831585af2a"
license = "Elastic License v2"
name = "Connection to Dynamic DNS Provider by a Signed Binary Proxy"
os_list = ["windows"]
version = "1.0.34"
version = "1.0.35"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and user.id : "S-1-5-21-*" and
[process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
(
process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
"powershell.exe", "pwsh.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe",
behavior/rules/windows/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml
+2 -2
View File
@@ -11,12 +11,12 @@ reference = [
"https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper",
"https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four",
]
version = "1.0.36"
version = "1.0.37"
query = '''
sequence by process.entity_id with maxspan=1m
/* execution of an unsigned PEfollowed by dns request to dynamic dns provider */
[process where event.action == "start" and user.id : "S-1-5-21-*" and
[process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
not process.code_signature.trusted == true and
process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*") and
not process.hash.sha256 :
behavior/rules/windows/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
+7 -6
View File
@@ -11,20 +11,20 @@ reference = [
"https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper",
"https://www.elastic.co/security-labs/globally-distributed-stealers",
]
version = "1.0.67"
version = "1.0.68"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and user.id : "S-1-5-21-*" and
[process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
(
process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
"msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
"msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe", "net.exe", "certutil.exe", "wmic.exe",
"ssh.exe", "scp.exe", "msiexec.exe") or
"msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe", "net.exe", "certutil.exe", "ssh.exe",
"scp.exe", "msiexec.exe", "bitsadmin.exe") or
process.pe.original_file_name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe",
"vbc.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe",
"RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe", "net.exe",
"certutil.exe", "wmic.exe", "msiexec.exe") or
"certutil.exe", "ssh.exe", "scp.exe", "msiexec.exe", "bitsadmin.exe") or
process.code_signature.subject_name == "OpenJS Foundation" or
process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
"?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
@@ -191,7 +191,8 @@ sequence by process.entity_id with maxspan=5m
"shorturl.at",
"bitly.cx",
"*.netlify.app",
"*.supabase.co"
"*.supabase.co",
"envs.sh"
) and
/* common to use powershell script by Microsoft Cloud sysadmins */
not (process.name : ("powershell.exe", "pwsh.exe", "javaw.exe", "node.exe", "dfsvc.exe") and
behavior/rules/windows/command_and_control_dns_over_https_by_an_unusual_process.toml
+2 -2
View File
@@ -8,11 +8,11 @@ license = "Elastic License v2"
name = "DNS Over HTTPS by an Unusual Process"
os_list = ["windows"]
reference = ["https://www.blackhillsinfosec.com/dns-over-https-for-cobalt-strike/"]
version = "1.0.3"
version = "1.0.4"
query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and user.id like "S-1-5-21-*" and
[process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
(
(process.executable : "C:\\Windows\\*.exe" and
process.code_signature.subject_name in ("Microsoft Windows Publisher", "Microsoft Corporation", "Microsoft Windows") and
behavior/rules/windows/command_and_control_execution_from_suspicious_stack_trailing_bytes.toml
+12 -1
View File
@@ -4,7 +4,7 @@ id = "0a26ccb6-41b9-418d-9314-854aadcb1fba"
license = "Elastic License v2"
name = "Execution from Suspicious Stack Trailing Bytes"
os_list = ["windows"]
version = "1.0.33"
version = "1.0.34"
query = '''
any where event.category in ("library", "api") and
@@ -107,6 +107,16 @@ any where event.category in ("library", "api") and
"0fb7450641ffc64883c628443bf0728b488b5c24784883c430415f415e415d415c*",
"488983100300004885c00f8433ffffff488*",
"488b5c2460488b6c2468488b7424704883c440415f415e5fc3cccc48895c24084889742410574883ec208b41144963f0488bf92b41103bf0*",
/* CCS-3 */
"*b800000000b9??0000004889d7f348ab*",
"*4153415141504883ec20*",
"*4151415241534883ec20*",
"*4152415041534883ec20*",
"*4883ec20b95bbc4a6aba*",
"*4883ec20b95d68fa3cba*",
"*4889d7f348ab*4883ec20*",
"*488b85e8030000488945c048c745c8*488b85e8030000488945d0*",
"*89c1488b4578488d9000100000488b85800000004189c84889c1*",
/* MYHANIB */
"85c0793ae98f0000004889c1ba5a4ce93be8*48894424684885c07478488b8c2420030000ba8828e950e8*000048894424784885c075a2eb5a488b",
"ba777791a7488983f00200004889c1e8*488b8bf0020000*48898338020000e8",
@@ -136,6 +146,7 @@ any where event.category in ("library", "api") and
"488945d0488b05??????00488b55d04889502848837dd0000f8470020000*",
"48898424100100004883bc241001000000751741b800000000ba00000000b905010000*",
"4889842430040000488b45104889c1e8????000089c2488d4424204989d0ba000000004889c1*",
"*488b55e84889501048837de8007422488b45e8*",
/* DANTE */
"8bf085c00f89b80000004983feff0f85ae000000488b5510*"
))
behavior/rules/windows/credential_access_access_to_windows_passwords_vault_by_unusual_process.toml
+3 -2
View File
@@ -11,7 +11,7 @@ reference = [
"https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5382",
"https://www.elastic.co/security-labs/detect-credential-access",
]
version = "1.0.4"
version = "1.0.5"
query = '''
any where event.category == "iam" and event.action in ("vault_credentials_read", "vault-credentials-were-read") and
@@ -22,7 +22,8 @@ any where event.category == "iam" and event.action in ("vault_credentials_read",
not (process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.executable : "?:\\Windows\\*.exe") and
not (process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\sppsvc.exe") and process.parent.executable : "?:\\Windows\\System32\\services.exe") and
not (process.executable : "C:\\Windows\\System32\\msiexec.exe" and process.parent.executable : "C:\\Windows\\System32\\msiexec.exe") and
not (process.name : "rundll32.exe" and process.command_line : "*inetcpl.cpl,ClearMyTracksByProcess*") and
not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and process.parent.executable : "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe") and
not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and process.parent.executable : "?:\\Windows\\System32\\rundll32.exe") and
not (process.executable : "C:\\Windows\\explorer.exe" and process.parent.executable : "C:\\Windows\\System32\\userinit.exe") and
not process.executable :
("?:\\Program Files\\*.exe",
behavior/rules/windows/credential_access_potential_discovery_of_dpapi_master_keys.toml
+2 -2
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Potential Discovery of DPAPI Master Keys"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.37"
version = "1.0.38"
query = '''
file where event.action == "open" and
@@ -16,7 +16,7 @@ file where event.action == "open" and
"?:\\USERS\\*\\APPDATA\\*\\MICROSOFT\\PROTECT\\S-1-12-1-*\\*",
"?:\\WINDOWS\\SYSTEM32\\MICROSOFT\\PROTECT\\S-1-5-18\\USER\\*") and
process.executable : ("C:\\*", "\\Device\\Mup\\*") and
user.id : ("S-1-5-21-*", "S-1-12-1-*") and
user.id like ("S-1-5-21*", "S-1-12-*") and
not file.name : ("desktop.ini", "exclude", ".fdignore", ".rgignore", ".ignore", ".gitignore") and
not process.executable :
("?:\\Program Files\\*",
behavior/rules/windows/credential_access_potential_discovery_of_windows_credential_manager_store.toml
+2 -2
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Potential Discovery of Windows Credential Manager Store"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.42"
version = "1.0.43"
query = '''
file where event.action == "open" and
@@ -17,7 +17,7 @@ file where event.action == "open" and
not file.name : ("desktop.ini", ".ignore", ".rgignore", "exclude", ".gitignore", ".fdignore") and
not file.extension : "?*" and file.name != null and
process.executable != null and
user.id : "S-1-5-21-*" and
user.id like ("S-1-5-21*", "S-1-12-*") and
not process.executable :
("?:\\Program Files\\*",
"?:\\Program Files (x86)\\*",
behavior/rules/windows/credential_access_unusual_kerberos_client_process.toml
+2 -2
View File
@@ -7,11 +7,11 @@ id = "b5c91c3e-9d2d-4df6-afb7-c9d236b5ebe2"
license = "Elastic License v2"
name = "Unusual Kerberos Client Process"
os_list = ["windows"]
version = "1.0.31"
version = "1.0.32"
query = '''
sequence by process.entity_id with maxspan=1m
[any where user.id like "S-1-5-21-*" and
[any where user.id like ("S-1-5-21*", "S-1-12-*") and
(
(event.category =="library" and dll.name : ("System.DirectoryServices.*.dll", "Wldap32.dll")) or
(event.category in ("network", "dns") and dns.question.name : "_ldap._tcp.*")
behavior/rules/windows/defense_evasion_api_call_from_a_process_with_a_spoofed_parent.toml
+3 -2
View File
@@ -7,7 +7,7 @@ id = "e62f022c-88e2-403f-9f83-f76a91dd2203"
license = "Elastic License v2"
name = "API Call from a Process with a Spoofed Parent"
os_list = ["windows"]
version = "1.0.8"
version = "1.0.9"
query = '''
sequence by process.entity_id
@@ -33,7 +33,8 @@ sequence by process.entity_id
"cfcaf06eaa34d603ff3a89dd0ddfe4b17c0ee7ad8fa4534634d24e1692a5e352",
"eb278baed0f9c422e9abb6bd947d7934086ea73080575ecb2ef4a7306ca5b037",
"d807a7b13f948f60bc9c299f2b6976bf3988532adc02df5ed4f44538f13f4275",
"8c5350999da9836037c67fd08bfb4e261d6e288a79c6b4fc3c8e3bd3d1f4171e")]
"8c5350999da9836037c67fd08bfb4e261d6e288a79c6b4fc3c8e3bd3d1f4171e",
"108bddeccbd09a4621d7702e53442c236a2623cb03b653ed89a1fa26007388ca")]
until [process where event.action:"end"]
'''
behavior/rules/windows/defense_evasion_api_call_from_a_suspicious_stack.toml
+45
View File
@@ -0,0 +1,45 @@
[rule]
description = """
Identifies the call to some Windows APIs from an unusual call stack. This may be the result of an evasion attempt to
hide the origin of the API call from the call stack such as unbacked memory region.
"""
id = "1089f634-35bd-4877-a638-01e42cb47ae2"
license = "Elastic License v2"
name = "API Call from a Suspicious Stack"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.1"
query = '''
api where process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "ResumeThread") and
process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|kernel32.dll|ntdll.dll" and
not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like
("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*",
"c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*",
"c:\\windows\\sys?????\\kernelbase.dll+0x*",
"c:\\windows\\sys?????\\ntdll.dll+0x*",
"c:\\windows\\sys?????\\kernelbase.dll!MsixIsSystemPackageByPackageFullName*"))
'''
min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.10.0"
behavior/rules/windows/defense_evasion_dll_side_loading_via_a_copied_microsoft_executable.toml
+4 -3
View File
@@ -12,7 +12,7 @@ reference = [
"https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
"https://www.microsoft.com/en-us/security/blog/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/",
]
version = "1.0.29"
version = "1.0.30"
query = '''
sequence by user.id with maxspan=5m
@@ -39,7 +39,7 @@ sequence by user.id with maxspan=5m
] by file.path
[library where
process.code_signature.subject_name : "Microsoft*" and process.code_signature.trusted == true and
not startswith~(dll.name, process.name) and
not startswith~(dll.name, process.name) and dll.hash.sha256 != null and
(dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and
not dll.code_signature.status : "trusted" and
@@ -53,7 +53,8 @@ sequence by user.id with maxspan=5m
"6c48d66731fcf6a60e7aef335c91e55ee27743df9912856c63302f7dfecde906",
"2e0559d248a68402d209d65e6009c05628fe6c30f892a1047fa3365a89d7d9a6",
"c7601b2f8b2439211433de59bda62a09347480bfdbbe03b4c560aa350c543e3a",
"7e1a25b50775cb246303ae162bba86c9d5fe2bd7fa98044899ffb58919b4ed3a") and
"7e1a25b50775cb246303ae162bba86c9d5fe2bd7fa98044899ffb58919b4ed3a",
"44f3a05334de6ca0b43ebd17f6c7f1935630e026f049f28828566e364b7f41aa") and
not (dll.path : "?:\\$WINDOWS.~BT\\Sources\\*.dll" and process.executable : "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe") and
not dll.path : "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\*.dll"
behavior/rules/windows/defense_evasion_remote_memory_write_to_trusted_target_process.toml
+7 -3
View File
@@ -7,7 +7,7 @@ id = "5c6c166c-a894-4263-918a-c7632014a486"
license = "Elastic License v2"
name = "Remote Memory Write to Trusted Target Process"
os_list = ["windows"]
version = "1.0.12"
version = "1.0.13"
query = '''
api where process.Ext.api.name == "WriteProcessMemory" and
@@ -56,7 +56,9 @@ not (process.name : "rundll32.exe" and process.Ext.api.parameters.size <= 140 an
"c:\\windows\\syswow64\\cwbunpls.dll",
"c:\\windows\\system32\\shsvcs.dll",
"c:\\windows\\system32\\sxssrv.dll",
"c:\\windows\\syswow64\\pgpce.dll") and
"c:\\windows\\syswow64\\pgpce.dll",
"c:\\windows\\system32\\hmpalert.dll",
"c:\\windows\\system32\\cloudap.dll") and
not process.thread.Ext.call_stack_final_user_module.protection_provenance in ("mfehcthe.dll", "system.core.ni.dll") and
not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like ("?:\\program files\\*", "?:\\program files (x86)\\*", "c:\\windows\\assembly\\nativeimages_*") and
not (process.thread.Ext.call_stack_final_user_module.name == "mscordbi.dll" and
@@ -228,7 +230,9 @@ not (process.name : "rundll32.exe" and process.Ext.api.parameters.size <= 140 an
"250c5f755d35a56189c7d557f1ea3b2827f26ff83c563df8a6cedb0114777fc0",
"f3553d5c7a36f67eb9934cc372ded8c2d592ae671ebd4297b0fbfd1cedad4205",
"0740759a6e479b0ff718e00c6f2d5f3c67db2ac31c787d2caa7e683588c23a03",
"4e0421b9849e2f873399832c44c1e858eef3dc37ac2ccd6dcb340ad35dfab63a") and
"4e0421b9849e2f873399832c44c1e858eef3dc37ac2ccd6dcb340ad35dfab63a",
"cb7ab3788d10940df874acd97b1821bbb5ee4a91f3eec11982bb5bf7a3c96443",
"5b6929aaaa7bd05bcaa5baa7ce8c4243804d6989f1c97ca44726ed124b49e9bb") and
not (process.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio*\\bin\\lib.exe" and
Target.process.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio*.exe" and process.thread.Ext.call_stack_final_user_module.name == "qt5xml.dll")
'''
behavior/rules/windows/discovery_external_ip_address_discovery_via_a_trusted_program.toml
+8 -5
View File
@@ -7,15 +7,18 @@ id = "51894221-7657-4b56-9406-e080e19ad159"
license = "Elastic License v2"
name = "External IP Address Discovery via a Trusted Program"
os_list = ["windows"]
version = "1.0.37"
version = "1.0.38"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and user.id : "S-1-5-21-*" and
[process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
(
process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
"powershell.exe", "pwsh.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe",
"installutil.exe","RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe") or
"installutil.exe","RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe") or
(process.name : "node.exe" and process.Ext.relative_file_name_modify_time <= 300) or
process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
"?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
"?:\\Program Files\\Java\\jre*\\bin\\java.exe",
@@ -72,7 +75,7 @@ sequence by process.entity_id with maxspan=5m
]
'''
min_endpoint_version = "7.15.0"
min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
@@ -98,4 +101,4 @@ name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "7.15.0"
min_endpoint_version = "8.4.0"
behavior/rules/windows/execution_attempt_to_mount_a_remote_webdav_share.toml
+2 -1
View File
@@ -7,12 +7,13 @@ id = "0a364281-5edc-4f75-a839-48b150cec3f2"
license = "Elastic License v2"
name = "Attempt to Mount a Remote WebDav Share"
os_list = ["windows"]
version = "1.0.9"
version = "1.0.10"
query = '''
process where event.action == "start" and
(
(process.name : "explorer.exe" and process.args : "\\\\*@*") or
(process.name : "rundll32.exe" and process.command_line : "*\\\\*@*,*" and process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe", "mshta.exe", "msiexec.exe")) or
(process.name : "net.exe" and process.args : "use" and
((process.args : ("http*:*", "*webdav*") and process.args : "/user*@*") or process.command_line : "*\\\\*@ssl\\*") and not process.command_line : "*//localhost*") or
(process.name : ("expand.exe", "xcopy.exe", "cmd.exe") and process.args : ("\\\\webdav*", "*DavWWWRoot*"))
behavior/rules/windows/execution_suspicious_command_shell_execution_via_windows_run.toml → behavior/rules/windows/execution_suspicious_command_execution_via_windows_run.toml
+6 -3
View File
@@ -5,16 +5,19 @@ victim to copy and paste malicious commands for execution via the Windows Run me
"""
id = "f4f436c8-5c4a-4f61-b0cc-17b154920887"
license = "Elastic License v2"
name = "Suspicious Command Shell Execution via Windows Run"
name = "Suspicious Command Execution via Windows Run"
os_list = ["windows"]
reference = [
"https://www.cloudsek.com/blog/unmasking-the-danger-lumma-stealer-malware-exploits-fake-captcha-pages",
]
version = "1.0.8"
version = "1.0.9"
query = '''
process where event.action == "start" and
process.name : ("cmd.exe", "powershell.exe", "curl.exe", "msiexec.exe", "mshta.exe", "wscript.exe", "cscript.exe") and
(
process.name : ("cmd.exe", "powershell.exe", "curl.exe", "msiexec.exe", "mshta.exe", "wscript.exe", "cscript.exe") or
(process.name : "rundll32.exe" and process.command_line : "*\\\\*@*,*")
) and
process.parent.name : "explorer.exe" and process.args_count >= 2 and
(
process.parent.thread.Ext.call_stack_summary like "ntdll.dll|kernelbase.dll|kernel32.dll|windows.storage.dll|shell32.dll|user32.dll|shell32.dll|explorer.exe|shcore.dll|*" or
behavior/rules/windows/execution_suspicious_javascript_execution_via_deno.toml
+46
View File
@@ -0,0 +1,46 @@
[rule]
description = """
Identifies attempts to execute JavaScript using Deno with suspicious command line value. Adversaries may abuse this
utility to execute malicious JavaScript.
"""
id = "ff18d24b-2ba6-4691-a17f-75c4380d0965"
license = "Elastic License v2"
name = "Suspicious JavaScript Execution via Deno"
os_list = ["windows"]
reference = ["https://deno.com/"]
version = "1.0.1"
query = '''
process where event.action== "start" and
(process.name : "deno.exe" or process.pe.original_file_name == "deno.exe" or process.code_signature.subject_name == "Deno Land Inc.") and
process.command_line : ("*javascript*base64*", "*eval(*", "*http*", "*javascript*import*")
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/windows/execution_suspicious_powershell_execution.toml
+15 -4
View File
@@ -12,7 +12,7 @@ reference = [
"https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper",
"https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
]
version = "1.0.48"
version = "1.0.49"
query = '''
process where event.action == "start" and process.name : "powershell.exe" and process.parent.executable != null and
@@ -149,7 +149,10 @@ process where event.action == "start" and process.name : "powershell.exe" and pr
"*DownloadFile*",
"*DownloadString*",
"* iex*",
"*;iex*",
"* iwr*",
"*;iwr *",
"*;saps *",
"* aQB3AHIAIABpA*",
"*Reflection.Assembly*",
"*Assembly.GetType*",
@@ -187,9 +190,17 @@ process where event.action == "start" and process.name : "powershell.exe" and pr
"*$env:computername*http*",
"*;InVoKe-ExpRESsIoN $COntent.CONTENt;*",
"*WebClient*example.com*",
"*=iwr $*;iex $*"
"*=iwr $*;iex $*",
"*gc *:*|sc *",
"*gci *-Recurse*start*",
"*Invoke-WebRequest*Start-Process*Hidden*",
"*Invoke-WebRequest*msiexec*"
) or
(process.command_line regex~ """.*p\"?o\"?w\"?e\"?r\"?s\"?h\"?e\"?l\"?l.*""" and not process.command_line : "*powershell*") or
(process.args: "bypass" and process.args : "hidden" and process.command_line : "*start-process*appdata*") or
(process.args : "-c" and process.args : "&{'*") or
(process.args : "-Outfile" and process.args : "Start*") or
@@ -199,9 +210,9 @@ process where event.action == "start" and process.name : "powershell.exe" and pr
process.args : "$*$*;set-alias" or
(process.command_line : ("*-encodedCommand*", "*Invoke-webrequest*", "*WebClient*", "*Reflection.Assembly*") and
(process.parent.name : ("explorer.exe", "python.exe") or
(process.parent.name : ("explorer.exe", "python*.exe") or
(process.parent.name : "cmd.exe" and
descendant of [process where event.action == "start" and process.name : ("explorer.exe", "python.exe")])))
descendant of [process where event.action == "start" and process.name : ("explorer.exe", "python*.exe")])))
)
'''
behavior/rules/windows/execution_suspicious_windows_command_shell_execution.toml
+4 -4
View File
@@ -7,7 +7,7 @@ id = "8dd7588d-fc28-40c0-adfb-14789c763984"
license = "Elastic License v2"
name = "Suspicious Windows Command Shell Execution"
os_list = ["windows"]
version = "1.0.56"
version = "1.0.57"
query = '''
process where event.action == "start" and
@@ -20,13 +20,13 @@ process where event.action == "start" and
"* explorer*%CD%*", "*%cd%\\*.js*", "*attrib*%CD%*", "*/?cMD<*", "*/AutoIt3ExecuteScript*..*", "*&cls&cls&cls&cls&cls&*",
"*&#*;&#*;&#*;&#*;*", "* &&s^eT*", "*& ChrW(*", "*&explorer /root*", "*start __ & __\\*", "*findstr /V /L *forfiles*",
"*=wscri& set *", "*http*!COmpUternaME!*", "*start *.pdf * start /min cmd.exe /c *\\\\*", "*pip install*System.Net.WebClient*",
"*Invoke-WebReques*Start-Process*", "*-command (Invoke-webrequest*", "*copy /b *\\\\* ping *-n*", "*echo*.ToCharArray*",
"*Invoke-WebRequest*Start-Process*", "*iwr *saps *", "*-command (Invoke-webrequest*", "*copy /b *\\\\* ping *-n*", "*echo*.ToCharArray*",
"*curl --ntlm -u*", "*bat'; iwr $*", "*http*.Content;*", "*&(gcm i?x)*", "*!*!*!*!*!*!*", "*&& !*!!*", "*for %? in (?) do @set*",
"*QUIT>>?&FTP/s:*", "*iwr -Uri*Start-Process*", "*irm https*| iex*", "*^S^T^a*", "*javascript:alert*",
"*QUIT>>?&FTP/s:*", "*iwr *Start-Process*", "*irm https*| iex*", "*^S^T^a*", "*javascript:alert*",
"* /v /c *&&set *&&set *&&set *&&set *&&set*", "*net use *@ssl*rundll32*", "*echo F | xcopy*/h /y &&*",
"* if /i \"%cd%\"==\"C:\\Windows\\System32\" ( echo *", "* if /i \"%cd%\"==\"C:\\Windows\\System32\" ( msg*",
"* if /i \"%cd%\"==\"C:\\Windows\\System32\" (mshta *", "*/c*start*.doc&exit*", "*/k*start msedge*http*&*", "*)) | Invoke-Expression\"",
"*/c *.bat&*.pdf*", "*/c *.bat&*.mp4*") or
"*/c *.bat&*.pdf*", "*/c *.bat&*.mp4*", "*set \"*& set \"*& set \"* call %*") or
(process.args_count == 3 and process.args : "%*%" and process.args:"/c") or
behavior/rules/windows/execution_windows_script_execution_from_archive_file.toml
+2 -2
View File
@@ -7,11 +7,11 @@ id = "816e1e39-e1a3-4935-9b7b-18395d244670"
license = "Elastic License v2"
name = "Windows Script Execution from Archive File"
os_list = ["windows"]
version = "1.0.29"
version = "1.0.30"
query = '''
process where event.action == "start" and
user.id : "S-1-5-21-*" and process.name : "wscript.exe" and
user.id like ("S-1-5-21*", "S-1-12-*") and process.name : "wscript.exe" and
(
/* execution from archive temp file */
process.args : ("?:\\Users\\*\\Temp\\7z*", "?:\\Users\\*\\Temp\\Rar$*", "?:\\Users\\*\\Temp\\Temp?_*") or
behavior/rules/windows/initial_access_execution_from_a_macro_enabled_office_document.toml
+2 -1
View File
@@ -11,7 +11,7 @@ os_list = ["windows"]
reference = [
"https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.31"
version = "1.0.32"
query = '''
process where event.action == "start" and
@@ -71,6 +71,7 @@ process where event.action == "start" and
"?:\\Windows\\SysWOW64\\DWWIN.EXE",
"?:\\WINDOWS\\system32\\dwwin.exe",
"?:\\Windows\\System32\\wermgr.exe",
"?:\\Windows\\SysWOW64\\wermgr.exe",
"?:\\Windows\\System32\\taskkill.exe",
"?:\\Windows\\System32\\Robocopy.exe",
"C:\\Windows\\SysWOW64\\verclsid.exe",
behavior/rules/windows/initial_access_suspicious_microsoft_iis_worker_descendant.toml
+4 -5
View File
@@ -10,7 +10,7 @@ os_list = ["windows"]
reference = [
"https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
]
version = "1.0.35"
version = "1.0.36"
query = '''
process where event.action == "start" and
@@ -47,13 +47,12 @@ process where event.action == "start" and
)
/* False Positives */
and not (process.name : "cmd.exe" and process.parent.args : "Icims" and process.command_line : "*vault.azure.net*" and process.parent.name : "w3wp.exe") and
not (process.name : "curl.exe" and process.args : "https://installerapi.lansweeper.com/v1/cloudsyncversions") and
not (process.name : "powershell.exe" and process.command_line : "\"powershell.exe\" netsh http show servicestate | ?{$_.Tostring().Contains(*") and
process.hash.sha256 != "fe1d2ad2781879dc05039d87bd12259f3bcf411c66c925d31827d6a757d33ec4" and
not (process.name == "curl.exe" and process.args == "https://discovery-gateway.lansweeper.com/versions/v1/cloudSyncVersions" and
process.parent.name == "w3wp.exe" and process.parent.args : "Lansweeper AppPool") and
not (process.name : "cmd.exe" and process.parent.name:"w3wp.exe" and
process.args:"'HttpsPortDesktopAgent')," and process.args : "echo" and process.parent.args : "DefaultAppPool")
process.args:"'HttpsPortDesktopAgent')," and process.args : "echo" and process.parent.args : "DefaultAppPool") and
not (process.name == "conhost.exe" and process.parent.name == "cmd.exe") and
not (process.name : "curl.exe" and process.args : "https*.lansweeper.com" and process.parent.name : "w3wp.exe" and process.parent.args : "Lansweeper AppPool")
'''
min_endpoint_version = "7.15.0"
behavior/rules/windows/persistence_persistence_via_extensible_firmware_modification.toml
+7 -3
View File
@@ -11,7 +11,7 @@ reference = [
"https://github.com/Cr4sh/s6_pcie_microblaze/blob/master/python/payloads/DmaBackdoorHv/bootkit_installer.ps1",
"https://securelist.com/finspy-unseen-findings/104322/",
]
version = "1.0.28"
version = "1.0.29"
query = '''
sequence by process.entity_id
@@ -52,14 +52,18 @@ sequence by process.entity_id
not (process.executable : "?:\\Windows\\HP\\Installer.exe" and process.args : "-bestsize" and process.args : "-uefisupport") and
not (process.code_signature.subject_name :
("Akeo Consulting", "HP Inc.", "Dell Inc", "Veritas Technologies LLC", "Insyde Software Corp.", "Huawei Technologies Co., Ltd.") and
("Akeo Consulting", "HP Inc.", "Dell Inc", "Dell Technologies Inc.", "Veritas Technologies LLC", "Insyde Software Corp.", "Huawei Technologies Co., Ltd.") and
process.code_signature.trusted == true) and
not (process.executable : "?:\\WINDOWS\\System32\\svchost.exe" and process.args : "BDESVC" and process.parent.name : "services.exe") and
not (process.executable : "?:\\Windows\\System32\\bcdboot.exe" and process.args : "/sysrepair" and process.parent.name : "svchost.exe") and
not (process.executable : "?:\\Windows\\System32\\bcdboot.exe" and process.args : "/f" and process.args : "?:\\Windows")
not (process.executable : "?:\\Windows\\System32\\bcdboot.exe" and process.args : "/f" and process.args : "?:\\Windows") and
not (process.executable : "?:\\Windows\\System32\\taskhostw.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and
process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Windows" and
(process.args : "taskhostw.exe" or process.args : "SBServicing" or process.args : "SYSTEM" or process.args : "ExploitGuardPolicy"))
] as event0
[file where event.action != "deletion" and file.path :"\\Device\\HarddiskVolume*\\EFI\\*" and
behavior/rules/windows/persistence_unusual_startup_shell_folder_modification.toml
+2 -2
View File
@@ -8,11 +8,11 @@ id = "377aad38-24e0-4dd7-93c2-bd231cb749e3"
license = "Elastic License v2"
name = "Unusual Startup Shell Folder Modification"
os_list = ["windows"]
version = "1.0.35"
version = "1.0.36"
query = '''
registry where
user.id : "S-1-5-21-*" and process.executable != null and
user.id like ("S-1-5-21*", "S-1-12-*") and process.executable != null and
registry.path : (
"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
behavior/rules/windows/privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation.toml
+2 -2
View File
@@ -12,14 +12,14 @@ reference = [
"https://docs.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-ifileoperation",
"https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.32"
version = "1.0.33"
query = '''
sequence with maxspan=1m
[file where event.action in ("creation", "overwrite", "rename", "modification") and
/* IFileOperation are performed by DllHost */
process.name : "dllhost.exe" and user.id : "S-1-5-21-*" and
process.name : "dllhost.exe" and user.id like ("S-1-5-21*", "S-1-12-*") and
/* executable file dropped via NewItem, Rename, Move or Copy IFileOperation */
(file.extension : "dll" or file.Ext.header_bytes : "4d5a*") and
behavior/rules/windows/privilege_escalation_potential_privilege_escalation_via_setwindowshook_dll_injection.toml
+54
View File
@@ -0,0 +1,54 @@
[rule]
description = """
Identifies a potentially untrusted DLL loaded by a privileged account from a suspicious location where the call stack
indicates a user-mode callback path consistent with SetWindowsHookEx-style window hook execution. Adversaries can abuse
window hooks to force a privileged process to load attacker-controlled DLLs and elevate privileges.
"""
id = "6eec7771-953c-46a0-9765-93000de1c237"
license = "Elastic License v2"
name = "Potential Privilege Escalation via SetWindowsHook DLL Injection"
os_list = ["windows"]
reference = [
"https://attack.mitre.org/techniques/T1055/001/",
"https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowshookexa",
]
version = "1.0.1"
query = '''
library where
user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
not dll.code_signature.status like ("trusted", "errorCode_endpoint*") and
process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|user32.dll|ntdll.dll" and
(dll.Ext.relative_file_creation_time <= 900 or dll.Ext.relative_file_name_modify_time <= 900) and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "?:\\Windows\\System32\\ntdll.dll!KiUserCallbackDispatcher*") and
not dll.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\System32\\*")
'''
min_endpoint_version = "8.12.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.001"
name = "Dynamic-link Library Injection"
reference = "https://attack.mitre.org/techniques/T1055/001/"
[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[internal]
min_endpoint_version = "8.12.0"
behavior/rules/windows/privilege_escalation_suspicious_desktop_window_manager_api_call.toml
+51
View File
@@ -0,0 +1,51 @@
[rule]
description = """
Identifies suspicious memory API calls by the Window Desktop Manager process. This may indicate a successful
vulnerability exploitation for privilege escalation.
"""
id = "1ddca85b-866b-4bee-96cd-ac5466f36e0a"
license = "Elastic License v2"
name = "Suspicious Desktop Window Manager API Call"
os_list = ["windows"]
reference = [
"https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2023/CVE-2023-36033.html",
"https://www.elastic.co/security-labs/itw-windows-lpe-0days-insights-and-detection-strategies",
"https://nvd.nist.gov/vuln/detail/cve-2024-30051",
]
version = "1.0.1"
query = '''
api where process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "ResumeThread", "WinExec", "SetThreadContext") and
process.executable : "?:\\Windows\\system32\\dwm.exe" and
(
process.thread.Ext.call_stack_summary like "*|combase.dll|user32.dll|dwmcore.dll|*" or
process.thread.Ext.call_stack_final_user_module.name == "combase.dll" or
(process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and process.thread.Ext.call_stack_final_user_module.protection_provenance == "combase.dll")
) and
not (process.Ext.api.name == "VirtualProtect" and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*", "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*")))
'''
min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"
[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[internal]
min_endpoint_version = "8.10.0"