admin/elastic-protections-artifacts
1
0
Fork 0
mirror of https://github.com/elastic/protections-artifacts synced 2026-06-08 14:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updating artifacts

Browse Source
This commit is contained in:
protectionsmachine
2025-10-22 10:06:45 +00:00
parent b5a0c1956d
commit ce6992ce98
117 changed files with 870 additions and 446 deletions
Download Patch File Download Diff File Expand all files Collapse all files
behavior/rules/cross-platform/execution_attempt_to_establish_vscode_remote_tunnel.toml
+72
View File
@@ -0,0 +1,72 @@
[rule]
description = """
Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to
establish a remote tunnel session to Github or a remote VScode instance.
"""
id = "13fd98ce-f1c3-423f-9441-45c50eb462c0"
license = "Elastic License v2"
name = "Attempt to establish VScode Remote Tunnel"
os_list = ["macos", "windows"]
reference = ["https://badoption.eu/blog/2023/01/31/code_c2.html"]
version = "1.0.10"
query = '''
process where event.type == "start" and event.action in ("exec", "start") and
process.name : ("code", "code.exe") and process.args : "tunnel" and
not (process.name : "code-tunnel*.exe" and process.args : ("status", "--log-to-file"))
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"
[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"
[[threat.technique.subtechnique]]
id = "T1102.002"
name = "Bidirectional Communication"
reference = "https://attack.mitre.org/techniques/T1102/002/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/cross-platform/execution_potential_reverse_shell_activity_via_terminal.toml
+3 -2
View File
@@ -9,7 +9,7 @@ reference = [
"https://github.com/WangYihang/Reverse-Shell-Manager",
"https://www.netsparker.com/blog/web-security/understanding-reverse-shells/",
]
version = "1.0.36"
version = "1.0.37"
query = '''
process where event.action == "exec" and process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
@@ -27,7 +27,8 @@ process.command_line like~ ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh
(
process.args like "/dev/tcp/nomzk-client-svc/*" and
process.executable like "/opt/cdf/data/containerd/state/io.containerd.runtime.v2.task/k8s.io/*/rootfs/usr/bin/bash"
)
) or
(process.args like "-l source*/tmp/claude*" and process.parent.name == "node")
)
'''
behavior/rules/linux/command_and_control_file_downloaded_via_curl_or_wget_to_hidden_directory.toml
+3 -2
View File
@@ -8,7 +8,7 @@ id = "dc1cee03-4923-4c6b-b00b-8a5c323bb753"
license = "Elastic License v2"
name = "File Downloaded via Curl or Wget to Hidden Directory"
os_list = ["linux"]
version = "1.0.9"
version = "1.0.10"
query = '''
process where event.type == "start" and event.action == "exec" and (
@@ -31,7 +31,8 @@ process where event.type == "start" and event.action == "exec" and (
"https://release-registry.services.sentry.io/apps/sentry-cli/*package=sentry-cli",
"https*github*astral-sh/rye/*",
"https://github.com/codecrafters-io/*"
)
) or
process.working_directory like ("/tmp/wbrashear/easybuild/*", "/var/tmp/pamac-build-*")
)
'''
behavior/rules/linux/command_and_control_network_connection_followed_by_file_creation.toml
+3 -2
View File
@@ -8,7 +8,7 @@ id = "08ad673a-7f99-417e-8b93-a79d4faeeed3"
license = "Elastic License v2"
name = "Network Connection Followed by File Creation"
os_list = ["linux"]
version = "1.0.9"
version = "1.0.10"
query = '''
sequence by process.entity_id with maxspan=5s
@@ -37,11 +37,12 @@ sequence by process.entity_id with maxspan=5s
"/usr/local/ltechagent*", "/var/lib/cloudendure/agent_keystore_temp", "/var/cache/yum/*",
"/run/aws-node/ipam.json.tmp*", "/run/systemd/journal/streams/.*"
) or
(process.executable == "/tmp/terraform" and file.path like "/tmp/terraform-provider*") or
process.name in ("podman", "minikube", "logrotate", "java", "aws-k8s-agent", "grafana", "postman") or
process.executable : (
"/etc/cron.daily/logrotate", "/etc/update-motd.d/50-motd-news", "/etc/cron.hourly/0yum-hourly.cron",
"/etc/cron.hourly/BitdefenderRedline", "/tmp/token_handler", "/tmp/.sentry-cli*.exe",
"/etc/cron.daily/0yum-daily.cron"
"/etc/cron.daily/0yum-daily.cron", "/etc/init.d/fortiedr"
)
)
]
behavior/rules/linux/command_and_control_python_network_connection_followed_by_file_creation.toml
-100
View File
@@ -1,100 +0,0 @@
[rule]
description = """
Detects network connections originating from Python, followed by a file creation event without a file extension. This
behavior is consistent with Python-based agents such as Medusa connecting to a C2 framework such as Mythic. The agent
polls the C2 for commands through a web request, after which the command gets executed.
"""
id = "1a2596ff-a5e7-4562-af17-97dbaf9284d5"
license = "Elastic License v2"
name = "Python Network Connection Followed by File Creation"
os_list = ["linux"]
version = "1.0.14"
query = '''
sequence by process.entity_id with maxspan=5s
[network where event.type == "start" and event.action == "connection_attempted" and
process.executable like ("/usr/bin/python*", "/bin/python*") and not (
destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
"FF00::/8"
)
)
]
[file where event.type == "creation" and event.action == "creation" and file.extension == null and not (
process.executable in ("/etc/cron.daily/0yum-daily.cron", "/tmp/trivy") or
file.name like ("tmp*", "*;*", "METADATA", "LICENSE") or
file.path like (
"/home/*", "/tmp/*", "/var/tmp/*", "/var/*", "/opt/*", "/etc/*", "/app*", "/run/*", "/root/*", "/nss/*",
"/dev/shm/sem.*", "/usr/lib/python*", "/config/*", "/builds/*", "/usr/local/*", "/reports/*", "/mnt/*",
"/srv/*", "/export/*", "/dev/shm/kcsig-key-*", "/usr/lib/systemd/system/*", "/lib/systemd/system/*",
"/vertex/storage/*", "/usr/lib/check_mk_agent/*", "/usr/bin/*", "/usr/lib64/*", "/repo/python/*",
"/dev/ptmx", "/data/smoke*KEYS", "/workspaces/*", "/dev/shm/pym-*", "/dev/shm/kcsig-data*",
"*/.local/lib/python*/site-packages/*", "/jenkins/.local/bin/pip", "/build/*", "/vidal/*", "/dev/shm/wgunicorn-*",
"/actions-runner/_work/tf-kafka-tools/tf-kafka-tools/*", "/data/tmp/lucene-*", "/data/lucene-*",
"/usr/share/connectors/*", "/jail/.well-known/acme-challenge/*", "/data/letsencrypt-acme-challenge/.well-known/acme-challenge/*"
) or
file.path regex~ """/dev/shm/[a-zA-Z0-9]{6}""" or
file.path regex~ """/dev/shm/nccl\-[a-zA-Z0-9]{6}""" or
file.path regex~ """/dev/shm/pym\-[0-9]{5}\-[a-z0-9]{8}""" or
(process.executable == "/usr/bin/python3" and file.path like ("/spam_check_attachments/*", "/prompts/*"))
)
]
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_chattr_execution_from_unusual_parent.toml
+8 -2
View File
@@ -11,7 +11,7 @@ os_list = ["linux"]
reference = [
"https://www.trendmicro.com/en_nl/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html",
]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "chattr" and
@@ -19,12 +19,18 @@ process where event.type == "start" and event.action == "exec" and process.name
process.args : ("-*i*", "+*i*", "+*u*", "-*u*") and not (
process.parent.name == "." or
process.parent.executable like ("./scannerYaraALFA*", "/tmp/newroot/lib/systemd/systemd", "./ldap2sshkeys") or
process.parent.executable in ("/tmp/newroot/usr/bin/sudo", "/tmp/newroot/usr/bin/zsh")
process.parent.executable in ("/tmp/newroot/usr/bin/sudo", "/tmp/newroot/usr/bin/zsh") or
process.parent.args like "/root/.ansible/tmp/ansible-tmp-*/AnsiballZ_file.py"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
behavior/rules/linux/defense_evasion_cron(d)_service_started_by_unusual_parent.toml
+4 -3
View File
@@ -7,7 +7,7 @@ id = "3ee903d9-6839-48d6-9437-3823b77bbeaa"
license = "Elastic License v2"
name = "Cron(d) Service Started by Unusual Parent"
os_list = ["linux"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "systemctl" and
@@ -19,10 +19,11 @@ process.parent.executable != null and not (
) or
process.parent.executable in (
"/opt/deepfence/start_deepfence_agent.sh", "/usr/bin/monit", "/usr/local/bin/gluster-client-toolkit", "/usr/bin/puppet",
"/opt/puppetlabs/puppet/bin/ruby"
"/opt/puppetlabs/puppet/bin/ruby", "/usr/local/sbin/devprom-restore", "/usr/bin/monit"
) or
process.parent.executable like ("/opt/eset/*", "/opt/monit/monit-*/bin/monit") or
process.parent.command_line like ("/usr/bin/python*", "/home/*/.ansible/tmp/ansible-tmp-*")
process.parent.command_line like ("/usr/bin/python*", "/home/*/.ansible/tmp/ansible-tmp-*") or
process.parent.args == "/usr/bin/deb-systemd-invoke"
)
'''
behavior/rules/linux/defense_evasion_curl_or_wget_egress_network_connection_via_lolbin.toml
+2 -1
View File
@@ -10,7 +10,7 @@ license = "Elastic License v2"
name = "Curl or Wget Egress Network Connection via LoLBin"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/#+shell"]
version = "1.0.12"
version = "1.0.13"
query = '''
sequence with maxspan=3s
@@ -44,6 +44,7 @@ sequence with maxspan=3s
"nice -10 /opt/aws/discovery/update", "xargs -n 1 curl -o lpsc -L", "/usr/bin/ruby /usr/bin/rake run:server_hooks",
"nohup ./update2.sh"
) or
process.parent.command_line in ("/bin/sh -c nice -n 15 $HOME/bin/cron.pl > /dev/null 2>&1", "/bin/sh /etc/cron.daily/rkhunter") or
process.command_line like ("*/home/linuxbrew/.linuxbrew/*", "*Homebrew*", "*webhook*") or
process.args like ("/usr/lib/jvm/*", "/root/.forge/provision-*.sh", "/usr/src/ucrm/scripts/update-certificates.sh", "/etc/periodic/weekly/update_mmdb.sh") or
(process.name == "nohup" and process.command_line like "nohup /usr/*/*.sh") or
behavior/rules/linux/defense_evasion_linux_compilation_in_suspicious_directory.toml
+60
View File
@@ -0,0 +1,60 @@
[rule]
description = """
Detects the compilation of a binary file in a suspicious directory. Attackers may compile kernel exploits or other
software on the target system, to ensure the architecture of the payload matches the target's architecture. Compilation
to one of these directories can be an indication of malicious activity.
"""
id = "52001df2-a3bf-411d-a09c-5f36a9f976b8"
license = "Elastic License v2"
name = "Linux Compilation in Suspicious Directory"
os_list = ["linux"]
version = "1.0.9"
query = '''
sequence with maxspan=10s
[process where event.action == "exec" and event.type == "start" and
process.name like~ (
"gcc*", "g++*", "c++", "cc", "c99", "c89", "cc1*", "cc1plus*", "clang*", "clang++*",
"musl-gcc", "musl-clang", "*-linux-gnu-gcc*", "*-linux-gnu-g++*", "*-pc-linux-gnu-gcc*",
"tcc", "zig", "ccache", "distcc"
) and
not process.parent.name in ("go", "cgo")
] as event0
[file where event.action == "creation" and process.name like~ (
"ld", "ld.*", "lld", "ld.lld", "mold", "collect2", "*-linux-gnu-ld*", "*-pc-linux-gnu-ld*"
) and file.path : "/dev/shm/*" and stringcontains~(event0.process.command_line, file.name)
]
'''
min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[[threat.technique.subtechnique]]
id = "T1027.004"
name = "Compile After Delivery"
reference = "https://attack.mitre.org/techniques/T1027/004/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.5.0"
behavior/rules/linux/defense_evasion_potential_proxy_execution_via_systemd_run.toml
+6 -3
View File
@@ -8,7 +8,7 @@ id = "1e5af062-4973-42d1-94bb-0c1ecbd8daa4"
license = "Elastic License v2"
name = "Potential Proxy Execution via Systemd-run"
os_list = ["linux"]
version = "1.0.16"
version = "1.0.17"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "systemd-run" and
@@ -22,7 +22,7 @@ process.parent.args_count < 3 and process.parent.name != null and not (
) or
process.parent.executable like (
"/opt/tableau/tableau_server/packages/scripts.*/after-install", "/opt/acronis/bin/acp-update-controller", "/snap/*",
"/var/lib/amagent/*"
"/var/lib/amagent/*", "/opt/msp-agent/msp-agent-core", "/opt/beyondtrust/*"
) or
process.parent.name like ("python*", "platform-python*") or
process.parent.name in (
@@ -41,7 +41,10 @@ process.parent.args_count < 3 and process.parent.name != null and not (
) or
process.parent.command_line in ("runc init", " /usr/local/bin/main") or
process.parent.command_line like ("*/var/lib/waagent/*", "bash ./run.sh") or
process.args in ("--help", "list-timers", "/usr/lib/udev/kdump-udev-throttler", "kubectl", "--unit=ngt_guest_agent_upgrade") or
process.args in (
"--help", "list-timers", "/usr/lib/udev/kdump-udev-throttler", "kubectl", "--unit=ngt_guest_agent_upgrade", "i3-zoom", "google-chrome",
"thunar", "/usr/bin/google-chrome-stable", "snap.lxd.workaround"
) or
process.working_directory == "/opt/Tychon/Endpoint/bin"
)
'''
behavior/rules/linux/defense_evasion_proxy_shell_execution_via_busybox.toml
-70
View File
@@ -1,70 +0,0 @@
[rule]
description = """
Detects the execution of a shell through Busybox. Attackers may use this technique to execute shells while attempting to
evade detection.
"""
id = "895ed985-a6ae-4ebe-b688-7ca8cd6e2e23"
license = "Elastic License v2"
name = "Proxy Shell Execution via Busybox"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/gtfobins/busybox/"]
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name == "busybox" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and not (
process.args == "-c" or
process.parent.args : (
"crond", "/usr/sbin/crond", "/local-registrator.sh", "/var/atlassian/application-data/bamboo-agent*"
) or
process.parent.command_line in (
"sh /readonly-config/fix-split-brain.sh",
"/bin/sh -c /health-check.sh || bash -c 'kill -s 15 $(pidof siridb-server) && (sleep 10; kill -s 9 $(pidof siridb-server))'"
) or
process.command_line == "bash /etc/kafka/docker/run" or
process.parent.command_line like (
"/bin/sh -c apk add*", "/bin/sh -c crm-cron-enabled*", "udhcpc -n -p /run/udhcpc.*", "flock -x*"
) or
process.working_directory == "/usr/share/grafana"
)
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"
behavior/rules/linux/defense_evasion_shared_object_injection_via_process_environment_variable.toml
+3 -2
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Shared Object Injection via Process Environment Variable"
os_list = ["linux"]
reference = ["https://attack.mitre.org/techniques/T1574/006/"]
version = "1.0.40"
version = "1.0.41"
query = '''
process where event.type == "start" and event.action == "exec" and process.env_vars like "LD_PRELOAD=?*" and
@@ -49,7 +49,8 @@ process where event.type == "start" and event.action == "exec" and process.env_v
"LD_PRELOAD=*/.mount_*", "LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2",
"LD_PRELOAD=/opt/deepinstinct/bin/libDeepInterception.so", "LD_PRELOAD=/usr/lib/preloadable_libiconv.so",
"LD_PRELOAD=./build/liblib.so", "LD_PRELOAD=/usr/libexec/sudo/sudo_noexec.so", "LD_PRELOAD=/home/oracle/*",
"LD_PRELOAD=/home/*/lib/python*/site-packages/*", "*LD_PRELOAD=*MATLAB*ld_shim.so.2.*"
"LD_PRELOAD=/home/*/lib/python*/site-packages/*", "*LD_PRELOAD=*MATLAB*ld_shim.so.2.*",
"LD_PRELOAD=/tmp/intercept-*/libear.so"
) or
process.parent.command_line == "runc init" or
process.parent.executable like (
behavior/rules/linux/defense_evasion_system_binary_copied_or_moved.toml
+2 -2
View File
@@ -7,7 +7,7 @@ id = "4daceba6-54be-4dfc-95ab-a4a9c19c77af"
license = "Elastic License v2"
name = "System Binary Copied or Moved"
os_list = ["linux"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("cp", "mv") and
@@ -53,7 +53,7 @@ process.args in (
"/usr/lib/dracut/dracut-install", "/usr/bin/make", "/bin/make", "/usr/share/initramfs-tools/hooks/*", "/var/lib/dpkg/info/*",
"/usr/local/bin/sigostclsh8.6", "/usr/lib/usrmerge/convert-usrmerge", "/usr/sbin/rear", "/usr/bin/byobu-status", "/sbin/rear",
"/usr/bin/find", "/tmp/newroot/nix/store/*/activate", "/nix/store/*/activate", "/var/lib/containers/storage/overlay/nix/store/*/activate",
"/var/lib/dpkg/tmp.ci/preinst", "/usr/sbin/nv-update-initrd", "/sbin/dracut"
"/var/lib/dpkg/tmp.ci/preinst", "/usr/sbin/nv-update-initrd", "/sbin/dracut", "/opt/SIGOS/*", "/tmp/newroot/usr/lib/dracut/dracut-install"
) or
process.working_directory like (
"/etc/localtime/var/lib/rancher", "/run/k3s/containerd/*", "/var/lib/docker/*", "/var/lib/rancher", "/var/tmp/portage/*"
behavior/rules/linux/defense_evasion_timestomping_detected_via_touch.toml
+2 -2
View File
@@ -8,7 +8,7 @@ id = "8012a863-8c0c-4461-bb88-b0193dfb9f38"
license = "Elastic License v2"
name = "Timestomping Detected via Touch"
os_list = ["linux"]
version = "1.0.13"
version = "1.0.14"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "touch" and
@@ -37,7 +37,7 @@ process.parent.executable != null and process.args like (
process.args in (
"/usr/bin/coreutils", "--no-create", "/etc/opt/lumu/lumud.conf", "/opt/vuso*", "/opt/diff", "/etc/aliases.db"
) or
process.args like ("--checkpoint=*", "/root/.config/envman/*", "/var/tmp/dracut*", "/var/tmp/portage*", "/snap/*") or
process.args like ("--checkpoint=*", "/root/.config/envman/*", "/var/tmp/dracut*", "/var/tmp/portage*", "/snap/*", "/var/tmp/pmlogger_*/stamp") or
process.command_line == "/bin/touch -a /tmp/au_status" or
process.parent.command_line == "runc init" or
process.working_directory in ("/opt/libexec", "/opt/local/src/connectxx/build/src/mdp")
behavior/rules/linux/discovery_linux_external_ip_address_discovery_via_curl.toml
+2 -2
View File
@@ -7,7 +7,7 @@ id = "18439a4c-cd67-43f5-ac42-5c4210edeacb"
license = "Elastic License v2"
name = "Linux External IP Address Discovery via Curl"
os_list = ["linux"]
version = "1.0.11"
version = "1.0.12"
query = '''
process where event.type == "start" and event.action == "exec" and process.name == "curl"
@@ -36,7 +36,7 @@ not (
"./Linux_Inventory_Sheets.sh", "/opt/qvm/bin/update_info_qsuite", "/usr/lib/check_mk_agent/local/public_ip_check",
"/opt/teleport/system/bin/teleport", "/opt/Elastic/Endpoint/elastic-endpoint", "/etc/update-motd.d/motd.sh",
"/opt/coe/cadence/IC231/tools.lnx86/cda/bin/64bit/cda.exe", "/etc/update-motd.d/10-armbian-header",
"/opt/saltstack/salt/bin/python*"
"/opt/saltstack/salt/bin/python*", "/usr/bin/python*"
) or
process.parent.args == "/var/www/html/admin/modules/leucoalarm/scripts/system.php" or
(
behavior/rules/linux/execution_linux_hidden_folder_or_file_execution_via_python.toml
+3 -2
View File
@@ -8,10 +8,11 @@ license = "Elastic License v2"
name = "Linux Hidden Folder or File Execution via Python"
os_list = ["linux"]
reference = ["https://github.com/rapid7/metasploit-framework"]
version = "1.0.9"
version = "1.0.10"
query = '''
process where event.type == "start" and event.action == "exec" and process.name : "python*" and
process where event.type == "start" and event.action == "exec" and
process.executable like~ ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
process.args : "python*" and process.args : ("/tmp/.*", "/var/tmp/.*", "/dev/shm/.*") and
not process.parent.name in ("browser_tests", "unit_tests", "arduino-cli", "node", "python.original") and
not process.args like ("/tmp/.build/*", "/tmp/.sentrycli*", "/var/tmp/.mount_GIMP*", "/tmp/.mount_GIMP*") and
behavior/rules/linux/execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
+7 -2
View File
@@ -8,7 +8,7 @@ id = "aa02591f-c9e6-4317-841e-0b075b9515ff"
license = "Elastic License v2"
name = "Linux Suspicious Child Process Execution via Interactive Shell"
os_list = ["linux"]
version = "1.0.12"
version = "1.0.13"
query = '''
process where event.type == "start" and event.action == "exec" and process.args like "-i" and process.args_count <= 2 and
@@ -23,7 +23,12 @@ process.parent.name like (
) or
process.parent.command_line in ("/bin/sh -c bash -i </dev/tty >/dev/tty 2>/dev/tty", "/bin/bash --login --posix") or
process.parent.command_line like "/usr/scratch/*poetry shell" or
process.command_line == "/opt/cursor.appimage -i"
process.command_line == "/opt/cursor.appimage -i" or
process.parent.executable like (
"/mnt/*/.vscode-server/bin/*/node", "/vscode/vscode-server/bin/*/node", "/home/*/.vscode-server/bin/*/node",
"/usr/scratch/*/.vscode-server/bin/*/node"
) or
(process.parent.command_line like ("*pipenv*", "*poetry*") and process.parent.args:"shell")
)
'''
behavior/rules/linux/execution_netcat_reverse_shell_via_busybox.toml
+2 -2
View File
@@ -8,12 +8,12 @@ id = "332a8018-6615-4d2d-aeff-61e85e5ae77b"
license = "Elastic License v2"
name = "Netcat Reverse Shell via Busybox"
os_list = ["linux"]
version = "1.0.2"
version = "1.0.3"
query = '''
sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and event.action == "exec" and process.name == "busybox" and
process.args : "*nc*"]
process.args like ("*nc*", "*netcat*", "*ncat*") and not process.args == "-z"]
[network where event.type == "start" and event.action == "connection_attempted" and process.name == "busybox" and
not (destination.ip == null or destination.ip == "0.0.0.0" or cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
behavior/rules/linux/execution_potential_linux_reverse_shell_via_java.toml
+3 -2
View File
@@ -7,7 +7,7 @@ id = "e0db3577-879e-4ac2-bd58-691e1343afca"
license = "Elastic License v2"
name = "Potential Linux Reverse Shell via Java"
os_list = ["linux"]
version = "1.0.12"
version = "1.0.13"
query = '''
sequence with maxspan=5s
@@ -47,7 +47,8 @@ sequence with maxspan=5s
process.command_line like~ (
"bash -c ps -eo pid,lstart,comm*",
"bash -c df -i /application | tail -n 1",
"/bin/sh -xe /tmp/hudson*.sh"
"/bin/sh -xe /tmp/hudson*.sh",
"bash -c cat /application/HES/*"
)
)
] by process.parent.entity_id
behavior/rules/linux/execution_printer_user_(lp)_shell_execution.toml
+5 -2
View File
@@ -17,7 +17,7 @@ reference = [
"https://gist.github.com/stong/c8847ef27910ae344a7b5408d9840ee1",
"https://github.com/RickdeJager/cupshax/blob/main/cupshax.py",
]
version = "1.0.4"
version = "1.0.5"
query = '''
process where event.type == "start" and event.action == "exec" and user.name == "lp" and
@@ -27,7 +27,10 @@ process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
"*/tmp/foomatic-*", "*-sDEVICE=ps2write*", "*printf*", "/bin/sh -e -c cat", "/bin/bash -c cat",
"/bin/bash -e -c cat", "/bin/sh -e -c pdftops*"
) or
process.args like "gs*"
process.args like (
"gs*", "/usr/lib/cups/filter/gstopdf", "/usr/lib/cups/filter/gstopxl", "/usr/lib/cups/filter/XeroxOfficeQScript",
"/usr/bin/foo2zjs-wrapper", "/usr/bin/foo2zjs-pstops", "foo2zjs-wrapper*"
)
)
'''
behavior/rules/linux/execution_renice_or_ulimit_execution_from_unusual_parent.toml
+6 -3
View File
@@ -9,7 +9,7 @@ id = "57ed0e43-643a-47f3-936e-138dc6f480da"
license = "Elastic License v2"
name = "Renice or Ulimit Execution from Unusual Parent"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and (
@@ -19,8 +19,11 @@ process where event.type == "start" and event.action == "exec" and (
)
) and process.parent.executable != null and
(process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*") or process.parent.name like ".*") and not (
process.parent.command_line == "/bin/sh /usr/bin/byobu-status tmux_right" or
process.parent.executable like ("/tmp/newroot/*", "/tmp/vmis.*/vmware-installer/vmis-launcher") or
process.parent.command_line in ("/bin/sh /usr/bin/byobu-status tmux_right", "runc init") or
process.parent.executable like (
"/tmp/newroot/*", "/tmp/vmis.*/vmware-installer/vmis-launcher", "/tmp/baum/easybuild/*", "/tmp/wbrashear/easybuild/*",
"/tmp/par-*/temp-*/nbsu"
) or
process.parent.name in ("java", "make", "python3.10.real")
)
'''
behavior/rules/linux/execution_script_executed_through_unusual_parent_process.toml
+2 -2
View File
@@ -8,7 +8,7 @@ id = "133102a7-f906-4725-b382-09257a0209c2"
license = "Elastic License v2"
name = "Script Executed Through Unusual Parent Process"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and process.args_count == 1 and
@@ -17,7 +17,7 @@ process where event.type == "start" and event.action == "exec" and process.args_
) and not (
process.parent.executable like~ (
"/tmp/newroot/*", "./merged/*", "/var/tmp/.mount_*/AppRun", "/tmp/.mount_cursor*/usr/bin//cursor",
"/tmp/baum/easybuild/*/perl"
"/tmp/baum/easybuild/*/perl", "/var/tmp/buildah*", "/tmp/taddm/fileinfo*", "/tmp/wbrashear/easybuild/*"
) or
process.parent.name in ("gogo", "nvim", "build-script-build", "jetbrains-toolbox", "runner") or
process.parent.command_line == "runc init"
behavior/rules/linux/execution_suspicious_execution_via_a_hidden_process.toml
+8 -2
View File
@@ -8,17 +8,23 @@ license = "Elastic License v2"
name = "Suspicious Execution via a Hidden Process"
os_list = ["linux"]
reference = ["https://www.elastic.co/security-labs/primer-on-persistence-mechanisms"]
version = "1.0.3"
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name : ".*" and process.args : (
"*/dev/tcp*", "*/dev/udp/*", "*import*pty*spawn*", "*import*subprocess*call*", "*TCPSocket.new*", "*TCPSocket.open*",
"*io.popen*", "*os.execute*", "*fsockopen*", "*disown*"
)
) and
not process.parent.command_line == "runc init"
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
behavior/rules/linux/execution_suspicious_mining_process_events.toml
+7 -5
View File
@@ -7,7 +7,7 @@ id = "fbf9342e-3d1e-4fba-a828-92fa0fb4d21b"
license = "Elastic License v2"
name = "Suspicious Mining Process Events"
os_list = ["linux"]
version = "1.0.22"
version = "1.0.23"
query = '''
process where event.action == "exec" and
@@ -17,10 +17,12 @@ process where event.action == "exec" and
(process.name=="systemctl" and process.args in ("disable", "stop", "kill", "start", "reload", "restart"))) and
process.args in ("aliyun.service", "moneroocean_miner.service", "c3pool_miner.service", "pnsd.service", "apache4.service", "pastebin.service", "xvf.service") and
/* exec via interactive shell */
not process.parent.command_line : ("bash", "-bash", "sh") and
not process.parent.executable : "/usr/local/share/aliyun-assist/*/update_install"
not (
/* exec via interactive shell */
process.parent.command_line : ("bash", "-bash", "sh") or
process.parent.executable : "/usr/local/share/aliyun-assist/*/update_install" or
process.parent.args like "/usr/local/share/aliyun-assist/*"
)
'''
min_endpoint_version = "7.15.0"
behavior/rules/linux/execution_suspicious_perl_command_execution.toml
+2 -2
View File
@@ -8,7 +8,7 @@ id = "13c404cb-7631-4a33-8b59-5545e9a8a598"
license = "Elastic License v2"
name = "Suspicious Perl Command Execution"
os_list = ["linux"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.type == "start" and event.action == "exec" and
@@ -30,7 +30,7 @@ process.args == "-e" and process.command_line like~ (
"/var/lib/docker/overlay2/*", "/usr/local/lp/apps/sonarpush-helpers/spectre-meltdown-checker.sh",
"/usr/sbin/debootstrap", "/usr/bin/xterm", "/usr/bin/xargs"
) or
process.parent.command_line like~ "*testfun()*" or
process.parent.command_line like~ ("*testfun()*", "sh -c bash -c testfun*") or
process.parent.args == "/usr/bin/parallel"
)
'''
behavior/rules/linux/execution_suspicious_ruby_command_execution.toml
+2 -2
View File
@@ -8,7 +8,7 @@ id = "a3a3b49c-c135-4959-8a1b-33392bb60991"
license = "Elastic License v2"
name = "Suspicious Ruby Command Execution"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
@@ -19,7 +19,7 @@ process.args like "-e*" and process.command_line like~ (
"*net/http*", "*socket*", "*open-uri*", "*pack(*", "*unpack(*"
) and
not (
process.working_directory like~ ("/etc/puppet/rack", "/builds/*") or
process.working_directory like~ ("/etc/puppet/rack", "/builds/*", "/var/tmp/portage/*") or
process.command_line like "*rails_env*" or
process.parent.command_line in ("emacs --daemon", "runc init") or
process.parent.name in ("emacs-gtk", "mmonit", "make") or
behavior/rules/linux/persistence_apt_package_manager_command_execution.toml
+6 -3
View File
@@ -14,7 +14,7 @@ reference = [
"https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
"https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/linux/local/apt_package_manager_persistence",
]
version = "1.0.11"
version = "1.0.12"
query = '''
sequence with maxspan=5s
@@ -43,12 +43,15 @@ sequence with maxspan=5s
"/usr/bin/perl -w /usr/sbin/dpkg-preconfigure --apt", "/bin/sh /usr/lib/needrestart/apt-pinvoke",
"/bin/sh /usr/bin/kali-check-apt-sources", "/bin/sh /usr/lib/needrestart/apt-pinvoke -m u",
"/usr/bin/perl /usr/sbin/needrestart", "/usr/bin/perl -w /usr/bin/apt-show-versions -i",
"/usr/bin/perl -w /usr/bin/apt-show-versions -i", "/usr/bin/perl -w /bin/apt-show-versions -i"
"/usr/bin/perl -w /usr/bin/apt-show-versions -i", "/usr/bin/perl -w /bin/apt-show-versions -i",
"/usr/bin/perl /bin/adequate --help", "/usr/bin/perl /usr/sbin/needrestart -m u",
"/usr/bin/perl -w /usr/share/debconf/frontend /usr/sbin/needrestart"
) or
process.parent.command_line in (
"sh -c if [ -x /usr/bin/etckeeper ]; then etckeeper post-install; fi",
"sh -c if [ -x /usr/bin/etckeeper ]; then etckeeper pre-install; fi"
)
) or
process.args in ("/usr/sbin/needrestart", "/usr/lib/needrestart/apt-pinvoke", "/usr/share/proxmox-ve/pve-apt-hook")
)
] by process.parent.entity_id
'''
behavior/rules/linux/persistence_apt_package_manager_egress_network_connection.toml
+7 -2
View File
@@ -14,7 +14,7 @@ reference = [
"https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
"https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/linux/local/apt_package_manager_persistence",
]
version = "1.0.6"
version = "1.0.7"
query = '''
sequence by process.entity_id with maxspan=5s
@@ -33,7 +33,12 @@ sequence by process.entity_id with maxspan=5s
process.name == "node" or
process.parent.executable : ("/var/lib/dpkg/*", "/var/lib/docker/*", "/usr/bin/supervisord") or
process.parent.name == "pip3" or
process.executable == "/opt/intel/oneapi/intelpython/python3.12/bin/python"
process.executable == "/opt/intel/oneapi/intelpython/python3.12/bin/python" or
process.parent.args like (
"/usr/lib/update-notifier/update-motd-updates-available", "/usr/bin/dpkg", "/usr/sbin/dpkg-preconfigure --apt || true",
"/usr/sbin/needrestart", "test -x /usr/lib/needrestart/apt-pinvoke && /usr/lib/needrestart/apt-pinvoke || true",
"/var/lib/dpkg/*"
)
)
]
[network where event.action == "connection_attempted" and event.type == "start" and not (
behavior/rules/linux/persistence_decode_activity_via_web_server.toml
+6 -4
View File
@@ -8,7 +8,7 @@ id = "eb928496-a992-4cee-9cd7-fc3fbae7e8da"
license = "Elastic License v2"
name = "Decode Activity via Web Server"
os_list = ["linux"]
version = "1.0.11"
version = "1.0.12"
query = '''
sequence with maxspan=5s
@@ -26,14 +26,16 @@ sequence with maxspan=5s
) and not (
process.name in ("getkeyfromldapuser.sh", "getVar.sh", "shell-archive") or
process.executable in ("/opt/omnimesh/apache/lib/passphrase", "/omd/sites/wopub/bin/apply_unsign_msi_patch.sh", "/opt/java/openjdk/lib/jspawnhelper") or
process.args like~ "/u01/app/oracle/*" or
process.executable like "/tmp/newroot/*" or
process.args like~ ("/u01/app/oracle/*", "-l source*/tmp/claude*") or
process.args == ".bamboo/deploy.sh" or
process.parent.executable in ("/bin/ruby", "/usr/lib/venv-salt-minion/bin/python.original", "/opt/morpheus/embedded/java/jre/bin/java") or
process.parent.executable like (
"/usr/bin/python*", "/opt/idea-IU*/jbr/bin/java", "/root/.vscode-server/*", "/home/*/.local/share/nvm/*node", "/h*/*/.cursor-server/*node",
"/home/*/cursor-agent/*node"
"/home/*/cursor-agent/*node", "/root/.cursor-server/cli/servers/*/server/node", "/*/*.cursor-server/*node", "/home/*.nvm/versions/node/*/node",
"/home/*/.local/share/cursor-agent/*/node"
) or
process.parent.args in ("./mmicro-control.pl", "/usr/bin/vncserver") or
process.parent.args in ("./mmicro-control.pl", "/usr/bin/vncserver", "/usr/local/bin/vncserver") or
process.parent.command_line like~ ("Serverd*", "*.ansible/tmp/ansible-tmp-*") or
process.command_line in ("sh -c man/base32.td/base32 --version 2>/dev/null", "/usr/bin/perl edit.cgi") or
(process.parent.name == "perl" and process.command_line like~ "sh -c man/base*") or
behavior/rules/linux/persistence_hidden_payload_executed_via_scheduled_job.toml
+3 -2
View File
@@ -13,7 +13,7 @@ reference = [
"https://intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/",
"https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
]
version = "1.0.17"
version = "1.0.18"
query = '''
process where event.type == "start" and event.action == "exec" and (
@@ -36,7 +36,8 @@ process where event.type == "start" and event.action == "exec" and (
"/bin/sh -c /root/bin/getssl -a -q -w /root/.getssl-acme.sectigo.com",
"/bin/sh -c /webmail/tools/alluser.pl > /webmail/modules/ad_sync/etc/.always_keep.list",
"/bin/sh -c bash /root/.pf-new-vpn-ssl-check.sh",
"/bin/sh -c /bin/bash $HOME/.backup.sh"
"/bin/sh -c /bin/bash $HOME/.backup.sh",
"/bin/sh -c /bin/mysql_tzinfo_to_sql /usr/share/zoneinfo/| /bin/mysql --defaults-file=/root/.my.cnf mysql"
) or
process.command_line like (
"*/home/*/.*.*", "*/opt/invgate/insight-agent/*", "*ansible*", "/bin/sh -c /backup/store_Weight_LABEL/.create_site.sh*",
behavior/rules/linux/persistence_motd_execution_followed_by_egress_network_connection.toml
+2 -9
View File
@@ -12,7 +12,7 @@ reference = [
"https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/",
"https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
]
version = "1.0.10"
version = "1.0.11"
query = '''
sequence by process.entity_id with maxspan=3s
@@ -29,14 +29,7 @@ sequence by process.entity_id with maxspan=3s
) or
(process.parent.executable == "/etc/update-motd.d/50-motd-news" and process.args == "https://motd.ubuntu.com") or
(process.parent.executable == "/etc/update-motd.d/motd.sh" and process.command_line == "curl -s ifconfig.me") or
(
process.parent.executable == "/etc/update-motd.d/50-amazon-linux-extras-news" and
process.command_line == "python -m amazon_linux_extras system_motd"
) or
(
process.executable == "/etc/update-motd.d/50-amazon-linux-extras-news" and
process.command_line == "/bin/bash /etc/update-motd.d/50-amazon-linux-extras-news"
)
process.parent.executable == "/etc/update-motd.d/50-amazon-linux-extras-news"
)
]
[network where event.type == "start" and event.action == "connection_attempted" and destination.ip != null and not (
behavior/rules/linux/persistence_potential_web_server_directory_traversal.toml
+5 -3
View File
@@ -8,7 +8,7 @@ id = "7d39db57-5c5e-4542-a9eb-8f5de524b09c"
license = "Elastic License v2"
name = "Potential Web Server Directory Traversal"
os_list = ["linux"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.type == "start" and event.action == "exec" and (
@@ -28,12 +28,14 @@ process.command_line like (
"*/etc/*", "*.ssh*", "*id_rsa*", "*authorized_keys*", "*/root/*", "*/dev/shm/*", "*/var/tmp/*", "*/tmp/*"
) and not (
process.parent.name in ("collect2", "gcc") or
process.name in ("collect2", "go", "ld", "chrpath", "node", "copyfiles", "bindgen", "elasticsearch-keystore") or
process.name in ("collect2", "go", "ld", "chrpath", "node", "copyfiles", "bindgen", "elasticsearch-keystore", "cc1", "as") or
process.command_line like (
"/bin/sh -c git*", "/home/*/.gradle/*Dcli.script=../../../../../../../../../distribution/*",
"/bin/sh -c printf*I../../../../../../nan*"
) or
process.executable like "/root/build/qtwebengine/src/core/*/x86_64/host/protoc"
process.executable like "/root/build/qtwebengine/src/core/*/x86_64/host/protoc" or
process.parent.executable like ("/home/*/.nvm/*node", "/sw/eb/sw/Python/3.12.3-GCCcore-13.3.0/bin/python3.12") or
process.args like "-l source*/tmp/claude*"
)
'''
behavior/rules/linux/persistence_scheduled_task_unusual_command_execution.toml
+8 -3
View File
@@ -12,7 +12,7 @@ reference = [
"https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/",
"https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
]
version = "1.0.11"
version = "1.0.12"
query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name in ("systemd", "cron", "crond") and
@@ -28,14 +28,19 @@ not (
"/bin/sh -c*backup.sh*logToFile.sh", "*api.github.com/meta*", "*/opt/commvault/*", "/bin/sh -c /home/*/sub/backup-archivelogs.sh*",
"*/usr/bin/curl -s https://check.torproject.org/torbulkexitlist*", "*/run/cloud-init/share/*.sock*",
"sh -c ldd /var/tmp/dracut*/initramfs/usr/bin/mkfifo*",
"""/bin/sh -c curl*http://127.0.0.1:*"""
"""/bin/sh -c curl*http://127.0.0.1:*""",
"/bin/sh -c curl -sSL https://*/scripts/linux/syslog-archival/report_syslog_v3.sh | bash -x > /var/log/report_syslog_v3.debug.out 2>&1"
) or
process.command_line in (
"/bin/sh -c /usr/bin/flock -n /dev/shm/loadwatch.lock -c /usr/local/lp/bin/loadwatch &> /dev/null",
"/bin/sh -c curl -L https://chef.io/chef/install.sh | bash", "sh -c ldd /usr/bin/mkfifo 2>&1",
"/bin/sh -c curl -s https://validca.libriciel.fr/retrieve-validca.sh | bash -s /data/certificate > /data/log/valica.log 2>&1 && supervisorctl apache2 reload >>/data/log/valica.log 2>&1",
"""/bin/bash -c echo "# Generated by a cronjob" > /usr/share/nginx/html/gh.txt; curl --silent https://api.github.com/meta | /usr/bin/jq -r \'.hooks[],.api[],.git[]\' >> /usr/share/nginx/html/gh.txt""",
"""sh -c /usr/bin/curl http://localhost:9901/server_info | /usr/bin/jq -r ".version""""
"""sh -c /usr/bin/curl http://localhost:9901/server_info | /usr/bin/jq -r ".version"""",
"/bin/sh -c export PM2_HOME=/home/genusadmin/.pm2 && curl -f http://localhost:8000/health || /usr/bin/pm2 restart genus --update-env >> /home/genusadmin/pm2_restart.log 2>&1",
"/bin/sh -c export PM2_HOME=/home/genusadmin/.pm2 && curl -f http://localhost:8001/health || /usr/bin/pm2 restart genus --update-env >> /home/genusadmin/pm2_restart.log 2>&1",
"/bin/bash -c curl -s https://get.upwind.io/sensor.sh | bash -s -- upgrade",
"/bin/sh -c /opt/arcsight/backup_local/backup.sh || /opt/arcsight/backup_local/backup_error.sh"
) or
process.working_directory like "/opt/nessus_agent/*"
)
behavior/rules/linux/persistence_suspicious_download_and_redirect_by_web_server.toml
+6 -2
View File
@@ -8,7 +8,7 @@ id = "fa71e336-0177-4732-b58b-53eb4a87a286"
license = "Elastic License v2"
name = "Suspicious Download and Redirect by Web Server"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.type == "start" and event.action == "exec" and (
@@ -43,7 +43,11 @@ process.command_line like (
process.parent.command_line like (
"/usr/bin/php*command:getSatelliteDatas*", "/usr/bin/php*command:getHailDatas*", "*ansible*"
) or
process.working_directory == "/home/ansible"
process.working_directory == "/home/ansible" or
(process.parent.args like "scripts/generator/*.py" and process.working_directory == "/usr/src/app") or
(process.parent.name == "java" and process.command_line like "*/home/asterisk/audio/*") or
(process.parent.name == "node" and process.command_line like~ "/bin/bash -O extglob*") or
(process.parent.name == "perl" and process.parent.args == "-X")
)
'''
behavior/rules/linux/persistence_suspicious_file_creation_via_web_server.toml
+2 -2
View File
@@ -7,7 +7,7 @@ id = "a67ef648-f04e-475c-8f53-a2db038ee834"
license = "Elastic License v2"
name = "Suspicious File Creation via Web Server"
os_list = ["linux"]
version = "1.0.5"
version = "1.0.6"
query = '''
sequence by process.entity_id with maxspan=3s
@@ -43,7 +43,7 @@ sequence by process.entity_id with maxspan=3s
file.name like~ "cookie*.txt" or
file.path like ("/tmp/requestdir/*", "/var/www/html/storage*", "/var/www/*/Cache/*", "/var/www/*/cache/*") or
file.extension like ("log", "*-*-*", "webm") or
process.executable like~ "root/miniconda3/bin/python*"
process.executable like~ "/root/miniconda3/bin/python*"
)
]
'''
behavior/rules/linux/persistence_udev_execution_followed_by_egress_network_connection.toml
+2 -2
View File
@@ -14,7 +14,7 @@ reference = [
"https://ch4ik0.github.io/en/posts/leveraging-Linux-udev-for-persistence/",
"https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms",
]
version = "1.0.8"
version = "1.0.9"
query = '''
sequence by process.entity_id with maxspan=3s
@@ -36,7 +36,7 @@ sequence by process.entity_id with maxspan=3s
"FF00::/8", "172.31.0.0/16"
) or
process.name == "go" or
process.executable like ("/var/lib/docker/overlay2/*gitlab-runner-helper", "/opt/tm/tools/go/usr/bin/go*") or
process.executable like ("/var/lib/docker/overlay2/*gitlab-runner-helper", "/opt/tm/tools/go/usr/bin/go*", "/var/lib/docker/overlay2/*/aws_signing_helper") or
process.executable in (
"/usr/local/bin/rclone", "/usr/lib/git/git-remote-https", "/usr/lib/apt/methods/https", "/usr/lib/apt/methods/http"
)
behavior/rules/linux/persistence_unusual_command_executed_by_web_server.toml
+4 -3
View File
@@ -7,7 +7,7 @@ id = "2d0e4305-c7b8-46af-8473-775a49c18ec3"
license = "Elastic License v2"
name = "Unusual Command Executed by Web Server"
os_list = ["linux"]
version = "1.0.19"
version = "1.0.20"
query = '''
process where event.type == "start" and event.action == "exec" and (
@@ -49,7 +49,7 @@ process.command_line like (
process.parent.args like (
"../scripts/python/build_all_recipes_firmware.py", "../scripts/python/build_all_no_recipes_firmware.py", "./ssh.py",
"/opt/ros/noetic/bin/robot_debugger", "./mmicro-control.pl", "/etc/webmin/miniserv.conf", "mintUpdate",
"/opt/tm/sshluks-setup/sshluks-setup.py", "/usr/bin/salt-minion"
"/opt/tm/sshluks-setup/sshluks-setup.py", "/usr/bin/salt-minion", "/usr/bin/puppet"
) or
process.parent.command_line like (
"./app", "runc init", "*cron_id=*", "/usr/bin/python*ansible*", "./pyenv/bin/python3 class/jobs.py", "Serverd listgend*",
@@ -70,7 +70,8 @@ process.command_line like (
process.command_line == "sh -c ssh-keygen -y -f ~/.ssh/id_ed25519"
) or
process.working_directory like~ ("/home/*", "/opt/kbport", "/usr/local/SolarWinds/Agent/bin/Plugins/APM") or
(process.working_directory == "/usr/share/httpd" and process.command_line == "/bin/bash -c /etc/cron.tasks/elearning.cron.sh")
(process.working_directory == "/usr/share/httpd" and process.command_line == "/bin/bash -c /etc/cron.tasks/elearning.cron.sh") or
process.parent.command_line == "python3 /opt/gateway/automation/backupscripts/commonutils/node_json_backup.py -f node_data.json -o /opt/node_json_backup -logfile /var/log/gateway/result_BackupService.log"
)
'''
behavior/rules/linux/privilege_escalation_potential_privilege_escalation_via_suid_binary.toml
+4 -2
View File
@@ -10,7 +10,7 @@ license = "Elastic License v2"
name = "Potential Privilege Escalation via SUID Binary"
os_list = ["linux"]
reference = ["https://gtfobins.github.io/#+suid"]
version = "1.0.6"
version = "1.0.7"
query = '''
process where event.type == "start" and event.action == "exec" and (
@@ -58,7 +58,9 @@ process where event.type == "start" and event.action == "exec" and (
) or
process.args == "/usr/local/zeek/bin/zeekctl cron" or
process.parent.args == "/usr/bin/supervisord" or
process.working_directory == "/usr/local/spine/bin"
process.working_directory == "/usr/local/spine/bin" or
(process.name == "sort" and process.parent.args == "/usr/lib/grub/grub-multi-install") or
(process.name == "minicom" and process.command_line == "minicom")
)
'''
behavior/rules/macos/command_and_control_file_download_from_suspicious_top_level_domain.toml
+59
View File
@@ -0,0 +1,59 @@
[rule]
description = """
Identifies network connections to commonly abused Top Level Domains followed by the immdiate creation of a Python, Shell
Script, Applescript, or Binary. This may indicate an attempt to establish initial access or command and control by a
malicious payload.
"""
id = "9a3acafe-2ecd-487f-8c1f-1697fe9d33c7"
license = "Elastic License v2"
name = "File Download from Suspicious Top Level Domain"
os_list = ["macos"]
version = "1.0.11"
query = '''
sequence by process.entity_id with maxspan=30s
[network where event.type == "start" and
destination.domain like~ ("*.team", "*.team.", "*.lol", "*.lol.", "*.app", "*.app.", "*.kr", "*.kr.", "*.ke", "*.ke.", "*.nu", "*.nu.", "*.space", "*.space.", "*.capital", "*.capital.", "*.in", "*.in.", "*.cfd", "*.cfd.", "*.online", "*.online.",
"*.info", "*.info.", "*.top", "*.top.", "*.buzz", "*.buzz.", "*.xyz", "*.xyz.", "*.rest", "*.rest.", "*.ml", "*.ml.", "*.cf", "*.cf.", "*.gq", "*.gq.", "*.ga", "*.ga.", "*.onion", "*.onion.",
"*.network", "*.network.", "*.monster", "*.monster.", "*.marketing", "*.marketing.", "*.cyou", "*.cyou.", "*.quest", "*.quest.", "*.cc", "*.cc.", "*.bar", "*.bar.", "*.click", "*.click.", "*.cam", "*.cam.",
"*.surf", "*.surf.", "*.tk", "*.tk.", "*.shop", "*.shop.", "*.club", "*.club.", "*.icu", "*.icu.", "*.pw", "*.pw.", "*.ws", "*.ws.", "*.rest", "*.rest.", "*.hair", "*.hair.",
"*.mom", "*.mom.", "*.beauty", "*.beauty.", "*.boats", "*.boats.", "*.online", "*.online.", "*.fun", "*.fun.", "*.life", "*.life.", "*.store", "*.store.")]
[file where event.action == "modification" and file.extension in ("py", "sh", "scpt", "pyc") and file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/private/var/tmp/*", "/var/tmp/*", "/private/var/root/*", "/var/root/*") and
not file.path like~ "/private/var/folders/*" and
not file.extension in ("so", "dylib")]
'''
min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.16.0"
behavior/rules/macos/defense_evasion_potential_binary_masquerading_via_invalid_code_signature.toml
+3 -2
View File
@@ -7,7 +7,7 @@ id = "4154c8ce-c718-4641-80db-a6a52276f1a4"
license = "Elastic License v2"
name = "Potential Binary Masquerading via Invalid Code Signature"
os_list = ["macos"]
version = "1.0.36"
version = "1.0.37"
query = '''
process where event.action == "exec" and
@@ -26,7 +26,8 @@ process where event.action == "exec" and
not process.Ext.effective_parent.executable in ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
"/System/Library/PrivateFrameworks/CoreSpeech.framework/corespeechd") and
not (process.Ext.effective_parent.executable == "/Applications/Visual Studio Code.app/Contents/MacOS/Electron" and process.name == "com.apple.WebKit.WebContent.Development") and
not process.code_signature.signing_id == "com.apple.WebKit.WebContent"
not process.code_signature.signing_id == "com.apple.WebKit.WebContent" and
not process.hash.sha256 in ("7519ac10c724566b7a57607cc2fc88a876bdd91a585e690c2480093b582c73e6", "930b075c52f829efcd431cee324403e1e8b03bf2039b1343aae31570034d30e2")
'''
min_endpoint_version = "8.7.0"
behavior/rules/macos/defense_evasion_suspicious_task_for_pid_system_call.toml
+5 -2
View File
@@ -15,7 +15,7 @@ reference = [
"https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/",
"https://wojciechregula.blog/post/learn-xpc-exploitation-part-3-code-injections/",
]
version = "1.0.33"
version = "1.0.34"
query = '''
process where event.action == "process_open" and
@@ -34,7 +34,10 @@ process where event.action == "process_open" and
not (startswith~(process.parent.executable, Target.process.executable) or
startswith~(process.executable, Target.process.executable)) and
not process.hash.sha256 : ("d41e02b5366b186a237f33150baa7c5ef4747ba06646a193ab9ba5125fc6ef7a",
"bee1a00ffb1c4b7c2c4784a1fdcb849dc7853b9deb5173ff4c5a08209c84bc26")
"bee1a00ffb1c4b7c2c4784a1fdcb849dc7853b9deb5173ff4c5a08209c84bc26") and
not (process.executable like "/Users/*/micromamba/envs/grid/bin/python3.11" and Target.process.executable == "/bin/bash") and
not (process.executable like "/Users/*/.local/share/uv/python/cpython-*-macos-aarch64-none/bin/python*" and Target.process.executable like "/Users/*/Code/eis-ray/.venv/lib/python*/site-packages/ray/core/src/ray/gcs/gcs_server") and
not (process.executable like "/Users/*/anaconda?/bin/python*" and Target.process.executable like "/Users/*/anaconda?/envs/python*/bin/python*")
'''
min_endpoint_version = "8.4.0"
behavior/rules/macos/defense_evasion_terminal_closed_with_pkill_or_killall.toml
+3 -2
View File
@@ -10,13 +10,14 @@ id = "266f9d58-2277-4e78-b551-7d07b3ed9020"
license = "Elastic License v2"
name = "Terminal closed with Pkill or Killall"
os_list = ["macos"]
version = "1.0.7"
version = "1.0.8"
query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("pkill", "killall") and
process.args like~ "Terminal" and (process.parent.executable like "/Volumes/*" or process.parent.name in ("bash", "sh", "zsh") or (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false)) and
not process.Ext.effective_parent.executable in ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
"/usr/local/jamf/bin/jamf")
"/usr/local/jamf/bin/jamf") and
not (process.parent.name == "bash" and process.parent.command_line == null)
'''
min_endpoint_version = "8.11.0"
behavior/rules/macos/execution_suspicious_script_or_process_execution_from_mounted_device.toml
+14 -1
View File
@@ -7,7 +7,7 @@ id = "c6ee0cc0-efc4-4353-bbfc-da16ebc4e1a5"
license = "Elastic License v2"
name = "Suspicious Script or Process Execution from Mounted Device"
os_list = ["macos"]
version = "1.0.39"
version = "1.0.40"
query = '''
sequence with maxspan=2m
@@ -24,6 +24,12 @@ sequence with maxspan=2m
((process.args == "-c" and process.args like~ ("*curl*", "*nscurl*", "*mktemp*", "*tail*", "*funzip*", "*python*", "*perl*", "*osascript*")) or process.args_count <= 2))) and not
process.executable like ("/private/tmp/PKInstallSandbox.*", "/opt/homebrew/Cellar/*") and not
process.name == "app-builder_arm64" and not
process.command_line in ("/bin/sh /opt/cisco/secureclient/bin/dart_uninstall.sh",
"/bin/sh /opt/cisco/secureclient/bin/umbrella_uninstall.sh",
"/bin/sh /opt/cisco/secureclient/securefirewallposture/bin64/posture_uninstall.sh",
"mktemp -t geinstall",
"chmod 0777 /Library/Caches/Xerox",
"chmod +x decompress") and not
process.args like~ ("/tmp/PKInstallSandbox.*/Scripts/*",
"/Library/Apple/System/Library/InstallerSandboxes/.*",
"/private/tmp/dmg.*/.PKInstallSandboxManager-SystemSoftware/*",
@@ -33,6 +39,13 @@ sequence with maxspan=2m
"/Library/PrivilegedHelperTools/*") and not
process.Ext.effective_parent.executable in
("/usr/local/jamf/bin/jamf",
"/usr/libexec/sshd-session",
"/Applications/iTerm.app/Contents/MacOS/iTerm2",
"/Library/Application Support/com.atera.ateraagent/Agent/.dotnet/dotnet",
"/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent",
"/Applications/censhare Client 2021.1.11 Java11/censhare Client.app/Contents/MacOS/censhare Client",
"/Applications/censhare Client 2021.1.2 Java11/censhare Client.app/Contents/MacOS/censhare Client",
"/Volumes/Data Recovery Wizard Installer/Data Recovery Wizard Installer.app/Contents/MacOS/Data Recovery Wizard Installer",
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon")]
'''
behavior/rules/macos/execution_user_tcc_db_access_by_unsigned_or_untrusted_process.toml
+4 -2
View File
@@ -10,13 +10,15 @@ os_list = ["macos"]
reference = [
"https://www.sentinelone.com/blog/session-cookies-keychains-ssh-keys-and-more-7-kinds-of-data-malware-steals-from-macos-users/",
]
version = "1.0.10"
version = "1.0.11"
query = '''
file where event.action == "open" and process.executable != null and
file.path like~ "/Users/*/Library/Application Support/com.apple.TCC/TCC.db" and
(process.code_signature.trusted == false or process.code_signature.exists == false) and
not Effective_process.executable like "/Applications/Vorta.app/Contents/MacOS/vorta-darwin"
not Effective_process.executable in ("/Applications/Vorta.app/Contents/MacOS/vorta-darwin",
"/Applications/CleanMyMac X.app/Contents/MacOS/CleanMyMac X",
"/Applications/CleanMyMac X.app/Contents/Library/LoginItems/CleanMyMac X HealthMonitor.app/Contents/MacOS/CleanMyMac X HealthMonitor")
'''
min_endpoint_version = "8.10.2"
behavior/rules/macos/persistence_persistence_via_suspicious_launch_agent_or_launch_daemon.toml
+12 -4
View File
@@ -14,7 +14,7 @@ reference = [
"https://objective-see.org/blog",
"https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket",
]
version = "1.0.51"
version = "1.0.52"
query = '''
persistence where event.action == "launch_daemon" and (Persistence.runatload == true or Persistence.keepalive == true) and
@@ -78,18 +78,24 @@ persistence where event.action == "launch_daemon" and (Persistence.runatload ==
"/opt/homebrew/opt/jenkins/bin/jenkins",
"/Library/airBalticBundle/.AnyConnect/fix_anyconnect_profile.sh",
"Location of the installed AutomationEngineSyncer executable (to be replaced by installer)",
"/Applications/.com.bomgar.bomgar-scc/Remote Support Customer Client.app/Contents/MacOS/bomgar-scc") and not
"/Applications/.com.bomgar.bomgar-scc/Remote Support Customer Client.app/Contents/MacOS/bomgar-scc",
"/opt/cisco/secureclient/bin/Cisco Secure Client - AnyConnect VPN Service.app/Contents/MacOS/vpnagentd",
"/Applications/Monotype Fonts/.Components/Services/CoreServices/MonotypeFontsMFEP",
"/Applications/Monotype Fonts/.Components/Services/CoreServices/MonotypeFontsMonitorService",
"rm -rf /usr/local/dgagent/; rm -rf /usr/local/lib/dgagent/; rm -f /Library/LaunchDaemons/com.verdasys.dgagent.plist /Library/LaunchAgents/com.verdasys.DgSessionSvc.plist;") and not
Effective_process.executable like~ ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
"/usr/local/sbin/FileWave.app/Contents/MacOS/fwcld",
"/usr/local/jamf/bin/jamf",
"/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
"/Library/PrivilegedHelperTools/com.bomgar.bomgar-scc.ElevationHelper.daemon",
"/Applications/MSP Anywhere Agent N-central.app/Contents/Resources/MSP Anywhere Helper",
"/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Library Manager.app/Contents/MacOS/kandji-library-manager") and not
process.executable like~ ("/System/*",
"/usr/local/sbin/FileWave.app/Contents/MacOS/fwcld",
"/Applications/Podman Desktop.app/Contents/MacOS/Podman Desktop",
"/Library/PrivilegedHelperTools/com.bomgar.bomgar-scc.ElevationHelper.daemon",
"/Library/PrivilegedHelperTools/*",
"/Library/PrivilegedHelperTools/*",
"/usr/local/munki/libexec/installhelper",
"/private/tmp/KSInstallAction.*/Install Google Software Update.app/Contents/Helpers/ksinstall") and not
process.code_signature.signing_id like ("com.bomgar.bomgar-scc",
"com.apple.vim",
@@ -103,7 +109,9 @@ persistence where event.action == "launch_daemon" and (Persistence.runatload ==
"coreutils",
"com.sublimetext.4",
"com.apple.ditto",
"NodewareAgent") and not
"NodewareAgent",
"com.logmein.Rescue",
"Antelope Launcher") and not
Persistence.executable like "/Applications/AhnLab/ASTx/astxd" and
not process.executable : "/Applications/mcpproxy.app/Contents/MacOS/mcpproxy"
'''
behavior/rules/windows/collection_keystrokes_input_capture_from_a_suspicious_module.toml
+5 -4
View File
@@ -1,7 +1,8 @@
[rule]
description = """
Identifies attempts to enumerate the state of keyboard keys and the call is coming from Python, AutoIt or LUA libraries.
Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.
Identifies attempts to enumerate the state of keyboard keys and the call is coming from Python, AutoIt, NodeJs or LUA
libraries. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user
types them.
"""
id = "ca00acf2-6e1b-4823-8fdd-7339ffa7079f"
license = "Elastic License v2"
@@ -11,7 +12,7 @@ reference = [
"https://attack.mitre.org/techniques/T1056/001/",
"https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
]
version = "1.0.5"
version = "1.0.6"
query = '''
api where
@@ -23,7 +24,7 @@ api where
) and
(
process.thread.Ext.call_stack_final_user_module.name : ("libffi*.dll", "python*.dll", "luacom.dll", "lua?.?.dll", "lua??.dll") or
process.code_signature.subject_name == "AutoIt Consulting Ltd"
process.code_signature.subject_name in ("AutoIt Consulting Ltd", "OpenJS Foundation")
) and
not (process.code_signature.subject_name == "NV Access Limited" and process.code_signature.trusted == true) and
behavior/rules/windows/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
+5 -3
View File
@@ -11,7 +11,7 @@ reference = [
"https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper",
"https://www.elastic.co/security-labs/globally-distributed-stealers",
]
version = "1.0.63"
version = "1.0.64"
query = '''
sequence by process.entity_id with maxspan=5m
@@ -72,11 +72,13 @@ sequence by process.entity_id with maxspan=5m
not process.parent.executable : ("C:\\Program Files\\Logi\\LogiBolt\\LogiBolt.exe",
"C:\\Program Files (x86)\\Avaya\\Avaya one-X Agent\\OneXAgentUI.exe",
"C:\\Program Files (x86)\\HP\\StatusAlerts\\bin\\HPStatusAlerts.exe",
"C:\\Program Files\\AutoHotkey\\AutoHotkeyU64.exe") and
"C:\\Program Files\\AutoHotkey\\AutoHotkeyU64.exe",
"C:\\Program Files\\Microsoft VS Code\\Code.exe") and
not (process.name : "powershell.exe" and process.parent.name : "wsmprovhost.exe" and
process.command_line : "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Version 5.1 -s -NoLogo -NoProfile") and
not (process.name : "curl.exe" and process.parent.name : "powershell.exe" and
process.command_line : "\"C:\\Windows\\System32\\curl.exe\" -L -s -H \"User-Agent: PowerShell\" -H \"Accept: application/vnd.github+json\" https://api.github.com/repos/PowerShell/PowerShell/releases")
process.command_line : "\"C:\\Windows\\System32\\curl.exe\" -L -s -H \"User-Agent: PowerShell\" -H \"Accept: application/vnd.github+json\" https://api.github.com/repos/PowerShell/PowerShell/releases") and
not (process.name : "curl.exe" and process.args : ("DNS: %{time_namelookup}s\\nConnect: %{time_connect}s\\nStartTransfer: %{time_starttransfer}s\\nTotal: %{time_total}s\\n", "https://login.microsoftonline.com/*"))
]
[dns where
dns.question.name :
behavior/rules/windows/command_and_control_connection_to_webservice_by_an_unsigned_binary.toml
+1 -2
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Connection to WebService by an Unsigned Binary"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/globally-distributed-stealers"]
version = "1.0.52"
version = "1.0.53"
query = '''
sequence by process.entity_id with maxspan=5m
@@ -101,7 +101,6 @@ sequence by process.entity_id with maxspan=5m
"*.sharepoint.com",
"note.youdao.com",
"mbasic.facebook.com",
"login.live.com",
"api.gofile.io",
"api.anonfiles.com",
"api.gofile.io",
behavior/rules/windows/command_and_control_ingress_tool_transfer_via_curl.toml
+5 -3
View File
@@ -7,7 +7,7 @@ id = "336ada1c-69f8-46e8-bdd2-790c85429696"
license = "Elastic License v2"
name = "Ingress Tool Transfer via CURL"
os_list = ["windows"]
version = "1.0.28"
version = "1.0.29"
query = '''
process where event.action == "start" and
@@ -32,11 +32,13 @@ process where event.action == "start" and
))
) and
/* lot of legit curl execution via custom bat scripts or interactively via cmd or powershell */
not (process.parent.name : "cmd.exe" and process.parent.args : "*.bat*") and
not (process.parent.name : "cmd.exe" and process.parent.args :( "*.bat*", "\\\\*.jpg", "curl -L -o \\\\*", "config_%c%a%b_%d%e%f.xml")) and
not (process.parent.name : ("cmd.exe", "powershell.exe") and process.parent.args_count == 1) and
not process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\nsc*.tmp\\*.exe" and
not process.command_line : "*curl -o \\\\.\\nul -v -I -L -s --connect-timeout*" and
not process.args : ("https://mirror.init7.net/ctan/systems*", "https://*.ctan.org*", "texlive/curl", "http*.local/*") and
not process.args : ("https://mirror.init7.net/ctan/systems*", "http://localhost:*",
"https://*.ctan.org*", "texlive/curl", "http*.local/*",
"http://control.firstvoucher.com/api/build/*zip") and
/* avoid breaking privileged install */
not user.id : "S-1-5-18"
behavior/rules/windows/command_and_control_suspicious_communication_via_mail_protocol.toml
+2 -1
View File
@@ -8,7 +8,7 @@ id = "0898f7c9-f667-4db1-a1ce-ddbf61a32361"
license = "Elastic License v2"
name = "Suspicious Communication via Mail Protocol"
os_list = ["windows"]
version = "1.0.16"
version = "1.0.17"
query = '''
sequence by process.entity_id with maxspan=3m
@@ -32,6 +32,7 @@ sequence by process.entity_id with maxspan=3m
"C:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*\\*",
"C:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*")
) and
not process.parent.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\Common7\\IDE\\CommonExtensions\\Platform\\Debugger\\VsDebugConsole.exe" and
not process.executable :
("?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\NisSrv.exe",
behavior/rules/windows/credential_access_autologons_access_attempt_via_registry.toml
+2 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "AutoLogons Access Attempt via Registry"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/SharpUp/blob/master/SharpUp/Checks/RegistryAutoLogons.cs#L26"]
version = "1.0.14"
version = "1.0.15"
query = '''
registry where event.action == "query" and process.executable != null and
@@ -36,6 +36,7 @@ registry where event.action == "query" and process.executable != null and
"?:\\Windows\\System32\\WindowsPowerShell\\v*\\powershell_ise.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCmdRun.exe",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
"?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe",
"\\Device\\Mup\\*\\Autologon.exe",
"?:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\ServicePortalAgent\\current\\emulator\\MmrAgent.NetFxEmulator.exe") and
not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*") and
behavior/rules/windows/credential_access_chrome_browser_spawned_from_an_unusual_parent.toml
+2 -1
View File
@@ -7,7 +7,7 @@ id = "fcbeaab7-017f-4bba-8b27-ffe68d64a28c"
license = "Elastic License v2"
name = "Chrome Browser Spawned from an Unusual Parent"
os_list = ["windows"]
version = "1.0.5"
version = "1.0.6"
query = '''
process where event.type == "start" and
@@ -30,6 +30,7 @@ process where event.type == "start" and
not (process.parent.code_signature.subject_name in (
"Google LLC", "Sound Research Corporation", "FactSet Research Systems Inc."
) and process.parent.code_signature.trusted == true) and
not (process.parent.name : "cmd.exe" and process.parent.args : "*\\Desktop\\*.bat " and process.args : "--profile-directory=Default") and
not (process.parent.name == "chromedriver.exe" and process.args == "--test-type=webdriver") and
not (process.parent.name == "gralvior-desktop.exe" and process.args == "https://google.com") and
not (process.parent.name == "rundll32.exe" and process.parent.args == "C:\\windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL") and
behavior/rules/windows/credential_access_lsass_access_attempt_from_unbacked_memory.toml
+6 -2
View File
@@ -7,7 +7,7 @@ id = "03efdaab-72af-4714-83ce-3abc10cab8d5"
license = "Elastic License v2"
name = "LSASS Access Attempt from Unbacked Memory"
os_list = ["windows"]
version = "1.0.15"
version = "1.0.16"
query = '''
sequence by process.entity_id with maxspan=3m
@@ -28,7 +28,11 @@ sequence by process.entity_id with maxspan=3m
not (process.executable : "?:\\Windows\\system32\\netstat.exe" and user.id == "S-1-5-18" and process.args : ("-a", "/a")) and
not (process.executable : "?:\\Windows\\system32\\tasklist.exe" and process.args : "/M") and
not (process.name : "powershell.exe" and process.args : "'C:\\ProgramData\\CentraStage\\AEMAgent\\Temp\\*.ps1'" and
process.parent.executable : "C:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe")
process.parent.executable : "C:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe") and
not (user.id == "S-1-5-18" and process.executable : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and
process.parent.command_line : ("cmd /c \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -File -\"",
"cmd /d /c \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -File -\"") and
process.working_directory : ("C:\\Program Files (x86)\\Tanium\\Tanium Client\\extensions\\comply\\data\\results\\*", "c:\\Program Files\\Nodeware\\"))
]
[credential_access where
Target.process.name : "lsass.exe" and
behavior/rules/windows/credential_access_potential_browser_credentials_stealer.toml
+3 -2
View File
@@ -7,14 +7,15 @@ id = "d154bb87-dc5d-4e6e-8be8-24f631ef09ff"
license = "Elastic License v2"
name = "Potential Browser Credentials Stealer"
os_list = ["windows"]
version = "1.0.2"
version = "1.0.3"
query = '''
sequence by process.entity_id with maxspan=1s
[file where event.action == "creation" and process.pid != 4 and process.executable != null and process.name != null and
not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
file.name : ("creditcards.db", "passwords.db", "autofilldata.db", "Google_Chome_Default.txt",
"creditcards.txt", "passwords.txt", "autofilldata.txt", "AutoFill.txt", "Bookmarks.txt", "Cards.txt")]
"creditcards.txt", "passwords.txt", "autofilldata.txt", "AutoFill.txt", "Bookmarks.txt", "Cards.txt") and
not (process.executable : "C:\\Program Files (x86)\\Genesys\\GenesysCloud\\GenesysCloud.exe" and file.name : "passwords.txt")]
[file where event.action == "creation" and process.pid != 4 and process.executable != null and process.name != null and
not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
file.name : ("creditcards.db", "passwords.db", "autofilldata.db", "Google_Chome_Default.txt",
behavior/rules/windows/credential_access_potential_discovery_of_dpapi_master_keys.toml
+3 -5
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Potential Discovery of DPAPI Master Keys"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.35"
version = "1.0.36"
query = '''
file where event.action == "open" and
@@ -17,7 +17,7 @@ file where event.action == "open" and
"?:\\WINDOWS\\SYSTEM32\\MICROSOFT\\PROTECT\\S-1-5-18\\USER\\*") and
process.executable : ("C:\\*", "\\Device\\Mup\\*") and
user.id : ("S-1-5-21-*", "S-1-12-1-*") and
not file.name : ("desktop.ini", "exclude", ".fdignore") and
not file.name : ("desktop.ini", "exclude", ".fdignore", ".rgignore", ".ignore", ".gitignore") and
not process.executable :
("?:\\Program Files\\*",
"?:\\Program Files (x86)\\*",
@@ -62,9 +62,7 @@ file where event.action == "open" and
process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) and
not (process.code_signature.subject_name : ("ESET, spol. s r.o.", "Intel(R) pGFX", "ForensiT Limited", "Johannes Schindelin") and
process.code_signature.trusted == true) and
not (process.name : "r-LiteCollector.exe" and process.code_signature.status : "errorCode_endpoint*") and
not (file.path : "?:\\windows\\system32\\Microsoft\\Protect\\S-1-5-18\\User\\.rgignore" and
process.name : "reg.exe" and process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation")
not (process.name : "r-LiteCollector.exe" and process.code_signature.status : "errorCode_endpoint*")
'''
min_endpoint_version = "8.0.0"
behavior/rules/windows/credential_access_potential_discovery_of_windows_credential_manager_store.toml
+6 -4
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Potential Discovery of Windows Credential Manager Store"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.40"
version = "1.0.41"
query = '''
file where event.action == "open" and
@@ -65,10 +65,12 @@ file where event.action == "open" and
"ITPRODUCTDEV LTD",
"JAM Software GmbH",
"GRAPHISOFT SE",
"Anysphere, Inc.") and process.code_signature.trusted == true)
"Anysphere, Inc.") and process.code_signature.trusted == true) and
not process.thread.Ext.call_stack_summary in ("ntdll.dll|sophosed.dll|apphelp.dll|kernelbase.dll|migcore.dll|migstore.dll|migcore.dll|scanstate.exe|kernel32.dll|ntdll.dll",
"ntdll.dll|sophosed.dll|apphelp.dll|kernelbase.dll|migcore.dll|loadstate.exe|kernel32.dll|ntdll.dll")
'''
min_endpoint_version = "8.0.0"
min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
@@ -94,4 +96,4 @@ name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.0.0"
min_endpoint_version = "8.7.0"
behavior/rules/windows/credential_access_sensitive_file_access_by_an_unsigned_process.toml
+67
View File
@@ -0,0 +1,67 @@
[rule]
description = """
Identifies an unsigned process accessing sensitive files. Adversaries may attempt to discover and acquire credentials
from system files.
"""
id = "a05ce4c0-ce89-47ab-9ca0-ecf2b3a9e5a4"
license = "Elastic License v2"
name = "Sensitive File Access by an Unsigned Process"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.2"
query = '''
file where event.action == "open" and
file.path : ("C:\\USERS\\*\\APPDATA\\*\\MICROSOFT\\PROTECT\\S-1-5-21*",
"C:\\USERS\\*\\APPDATA\\*\\MICROSOFT\\PROTECT\\S-1-12-1*",
"C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Vault\\*-*",
"C:\\Windows\\SysWOW64\\LogFiles\\SAM",
"C:\\Windows\\System32\\config\\RegBack\\SAM",
"C:\\Windows\\System32\\config\\RegBack\\SECURITY",
"C:\\Windows\\System32\\config\\RegBack\\SYSTEM") and
process.executable : ("C:\\*", "\\Device\\Mup\\*") and
(process.code_signature.trusted == false or process.code_signature.exists == false) and
not file.name : ("desktop.ini", ".ignore", ".rgignore", "exclude", ".gitignore", ".fdignore") and
not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
not (process.name : "loki.exe" and file.extension : "vsch") and
not (file.path : "C:\\Windows\\System32\\config\\RegBack\\SAM" and
process.executable : ("C:\\ProgramData\\Guardicore\\utils\\osqueryd.exe", "C:\\ProgramData\\Guardicore\\utils\\gc-insight.exe"))
'''
min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.002"
name = "Security Account Manager"
reference = "https://attack.mitre.org/techniques/T1003/002/"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.4.0"
behavior/rules/windows/credential_access_sensitive_file_access_cloud_credentials.toml
+2 -2
View File
@@ -8,13 +8,13 @@ license = "Elastic License v2"
name = "Sensitive File Access - Cloud Credentials"
os_list = ["windows"]
reference = ["https://github.com/GhostPack/Seatbelt"]
version = "1.0.32"
version = "1.0.33"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
user.id like ("S-1-5-21*", "S-1-12-*") and process.executable != null and
not (process.code_signature.subject_name : "Johannes Schindelin" and process.code_signature.status == "trusted") and
not (process.code_signature.subject_name : ("Johannes Schindelin", "Anaconda, Inc.") and process.code_signature.status == "trusted") and
not (process.code_signature.subject_name : "Python Software Foundation" and
process.executable : "?:\\Users\\*\\AppData\\Local\\Google\\Cloud SDK\\google-cloud-sdk\\platform\\bundledpython\\python.exe") and
not process.executable :
behavior/rules/windows/credential_access_suspicious_access_to_lsa_secrets_registry.toml
+2 -1
View File
@@ -12,7 +12,7 @@ reference = [
"https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets",
"https://github.com/gtworek/PSBits/tree/master/LSASecretDumper",
]
version = "1.0.40"
version = "1.0.41"
query = '''
registry where event.action != "modification" and
@@ -27,6 +27,7 @@ registry where event.action != "modification" and
"?:\\Program Files\\RepairTech\\LiveAgent\\SyncroLive.Agent.Runner.exe",
"?:\\Program Files\\Common Files\\Adobe\\Creative Cloud Libraries\\CCLibrary.exe",
"?:\\Windows\\System32\\SpecopsClient\\SecuredBrowserNet\\SecuredBrowserDotNetLauncher.exe",
"?:\\Program Files (x86)\\Tripwire\\TFS\\Bin\\tripwire.exe",
"?:\\Windows\\regedit.exe",
"?:\\Program Files\\Dell\\Dell Data Protection\\Encryption\\EmsService.exe",
"?:\\Program Files (x86)\\Imperva\\RemoteAgent\\RemoteAgentCtrl.exe",
behavior/rules/windows/credential_access_suspicious_registry_hive_dump.toml
+3 -2
View File
@@ -11,7 +11,7 @@ reference = [
"https://adsecurity.org/?page_id=1821",
"https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
]
version = "1.0.6"
version = "1.0.7"
query = '''
any where
@@ -25,7 +25,8 @@ any where
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*advapi32.dll!RegSaveKey*") and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "Unbacked*" and $entry.callsite_trailing_bytes : "?*"))
) and
process.executable != null and
process.executable != null and
not (process.code_signature.subject_name == "VS REVO GROUP OOD" and process.code_signature.trusted == true) and
not process.executable : ("?:\\Program Files\\Commvault\\ContentStore\\Base\\CLBackup.exe",
"?:\\Program Files (x86)\\Commvault\\ContentStore\\Base\\CLBackup.exe",
"?:\\Program Files\\VS Revo Group\\Revo Uninstaller Pro\\RevoUninPro.exe",
behavior/rules/windows/defense_evasion_allowprotectedrenames_registry_modification.toml
+2 -2
View File
@@ -10,12 +10,12 @@ os_list = ["windows"]
reference = [
"https://qtechbabble.wordpress.com/2020/06/26/use-pendingfilerenameoperations-registry-key-to-automatically-delete-a-file-on-reboot/",
]
version = "1.0.4"
version = "1.0.5"
query = '''
registry where process.name != null and
registry.value : "AllowProtectedRenames" and registry.data.strings : "1" and
not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (86)\\*") and
not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (86)\\*", "\\Device\\Mup\\lansweeper\\*$\\uninstall_flash_player.exe") and
not (process.code_signature.status : "trusted" and not process.code_signature.subject_name : "Microsoft*")
'''
behavior/rules/windows/defense_evasion_attempt_to_hide_files_via_registry_modification.toml
+2 -1
View File
@@ -7,7 +7,7 @@ id = "4f7b1362-1299-4ce7-8e02-03b74dad4eb1"
license = "Elastic License v2"
name = "Attempt to Hide Files via Registry Modification"
os_list = ["windows"]
version = "1.0.4"
version = "1.0.5"
query = '''
registry where event.action == "modification" and process.executable != null and
@@ -34,6 +34,7 @@ registry where event.action == "modification" and process.executable != null and
"C:\\Windows\\System32\\regsvr32.exe",
"C:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
"C:\\ADP SmartCompliance PowerTool\\Compliance.exe",
"D:\\USMT\\X64\\loadstate.exe",
"C:\\Program Files\\*.exe",
"C:\\Program Files (x86)\\*.exe") and
not (process.code_signature.subject_name : ("Cyberdigm. Corp.", "CYBERDIGM CO., LTD.", "Electronic Arts, Inc.") and process.code_signature.trusted == true)
behavior/rules/windows/defense_evasion_direct_syscall_from_unsigned_module.toml
+3 -2
View File
@@ -12,7 +12,7 @@ reference = [
"https://www.elastic.co/security-labs/doubling-down-etw-callstacks",
"https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs",
]
version = "1.0.23"
version = "1.0.24"
query = '''
api where process.Ext.api.behaviors == "direct_syscall" and
@@ -113,7 +113,8 @@ api where process.Ext.api.behaviors == "direct_syscall" and
"669ee31e18f1901098d0b296e0ebbe38b5602bf4c17000dda9409aa5bd64133a",
"499b68eb465d06a2b23c2da325786e15d721c3a0d7a32ce6f57305886cfb09d8",
"22121600323bc22f24944a97e0ea4b8b2250b9541f0505c1f1569ac8e585659f",
"5b4f622cb9b451a6427fc9caebecd7662ec14af325697c4619ec61b7117d6273") and
"5b4f622cb9b451a6427fc9caebecd7662ec14af325697c4619ec61b7117d6273",
"da7dfd4b7df4f2813428306649b10d1f2d6d71c1d43c5cfffe880101d62d7b08") and
not (process.Ext.api.name == "VirtualProtect" and process.Ext.api.metadata.target_address_name == "terminal64.exe" and
process.thread.Ext.call_stack_final_user_module.name == "terminal64.exe") and
not (process.Ext.api.name == "VirtualProtect" and process.thread.Ext.call_stack_summary == "Unbacked") and
behavior/rules/windows/defense_evasion_native_api_call_from_unsigned_module.toml
+3 -2
View File
@@ -7,7 +7,7 @@ id = "27202cd8-c5a6-4b82-9bb8-f3da69a4d5d3"
license = "Elastic License v2"
name = "Native API Call from Unsigned Module"
os_list = ["windows"]
version = "1.0.5"
version = "1.0.6"
query = '''
api where
@@ -63,7 +63,8 @@ not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
"f9d96115b770e86878dda0abe837a4922a67f1621c1c09a713d9e5259b7daba7",
"e4aefb3e93a05959581f99378cfb034c5c4bf072063fa82572fe271a835d7c3d",
"3e7873f34404c87d7b2db9f6a460f3caa22a36f093a01ad50494863b392569ce",
"cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc") and
"cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc",
"d5006c0d9e14d5c9e96936405c4ad2a6aab4e6756dac16fcbdfffe47efb807dd") and
not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry,
($entry.trusted == true or $entry.status == "errorExpired") and
$entry.subject_name in (
behavior/rules/windows/defense_evasion_ntdll_loaded_from_an_unusual_path.toml
+2 -1
View File
@@ -10,7 +10,7 @@ os_list = ["windows"]
reference = [
"https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.37"
version = "1.0.38"
query = '''
library where dll.pe.original_file_name : "ntdll.dll" and
@@ -18,6 +18,7 @@ library where dll.pe.original_file_name : "ntdll.dll" and
not dll.path : ("?:\\Windows\\SysWOW64\\ntdll.dll",
"?:\\Windows\\System32\\ntdll.dll",
"?:\\Windows\\System32\\ntdll.dll.???",
"?:\\Windows\\SyChpe32\\ntdll.dll",
"?:\\Windows\\WinSxS\\amd64_microsoft-windows-ntdll_*\\ntdll.dll",
"?:\\Windows\\WinSxS\\wow64_microsoft-windows-ntdll_*\\ntdll.dll",
"?:\\Windows\\WinSxS\\Temp\\InFlight\\*\\amd64_microsoft-windows-ntdll_*\\ntdll.dll",
behavior/rules/windows/defense_evasion_potential_cve_2024_21338_exploitation.toml
+7 -2
View File
@@ -10,7 +10,7 @@ os_list = ["windows"]
reference = [
"https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/",
]
version = "1.0.6"
version = "1.0.7"
query = '''
api where
@@ -30,7 +30,12 @@ api where
process.thread.Ext.call_stack_final_user_module.path like "c:\\windows\\system32\\esent.dll") and
_arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $caller, $caller.trusted == true)) and
process.thread.Ext.call_stack_final_user_module.hash.sha256 != "20fae5e8376514a6e500af5a84d08f0f6c58b3302f5c8da48aa74e815a0e78de" and
not process.thread.Ext.call_stack_final_user_module.path like ("c:\\windows\\system32\\mpssvc.dll", "c:\\windows\\system32\\wevtsvc.dll", "c:\\windows\\assembly\\nativeimages_*\\mscorlib.ni.dll")
not process.thread.Ext.call_stack_final_user_module.path like ("c:\\windows\\system32\\mpssvc.dll", "c:\\windows\\system32\\wevtsvc.dll", "c:\\windows\\assembly\\nativeimages_*\\mscorlib.ni.dll") and
not (process.executable : "C:\\Program Files\\Windows Defender Advanced Threat Protection\\Classification\\SenseCE.exe" and
process.parent.executable : "C:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe") and
not (process.executable : "C:\\Windows\\System32\\WUDFHost.exe" and process.parent.executable : "C:\\Windows\\System32\\services.exe" and
process.thread.Ext.call_stack_final_user_module.name == "ipf_umdf2.dll") and
not (process.executable : "C:\\Windows\\System32\\svchost.exe" and process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\cdp.dll")
'''
min_endpoint_version = "8.14.0"
behavior/rules/windows/defense_evasion_potential_evasion_via_clipup_execution.toml
+46
View File
@@ -0,0 +1,46 @@
[rule]
description = """
Identifies the execution of the ClipUp process from an unusual parent and with the -ppl argument. This may indicate an
attempt to overwrite protected files to tamper with endpoint security solutions.
"""
id = "af6ca1a9-650f-4984-b83d-fc0a3b118c74"
license = "Elastic License v2"
name = "Potential Evasion via ClipUp Execution"
os_list = ["windows"]
reference = ["https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html"]
version = "1.0.2"
query = '''
process where event.action == "start" and
process.executable : "?:\\Windows\\System32\\ClipUp.exe" and process.args : "-ppl" and process.Ext.protection like "PsProtectedSigner*" and
not process.parent.executable : ("?:\\Windows\\System32\\ClipUp.exe", "?:\\Windows\\System32\\smss.exe", "?:\\Windows\\System32\\conhost.exe") and
process.parent.executable != null
'''
min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.0.0"
behavior/rules/windows/defense_evasion_potential_evasion_via_invalid_code_signature.toml
+9 -4
View File
@@ -9,14 +9,14 @@ license = "Elastic License v2"
name = "Potential Evasion via Invalid Code Signature"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.18"
version = "1.0.19"
query = '''
any where
process.executable != null and process.code_signature.status == "errorBadDigest" and
(
(event.category == "api" and event.category == "intrusion_detection" and
process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode", "unbacked_rwx") and
process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
not process.Ext.api.name in ("SetWindowsHookEx", "IoCreateDevice") and
process.thread.Ext.call_stack_final_user_module.name != null and
not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unknown", "Undetermined") and
@@ -34,7 +34,8 @@ any where
not (dll.name == "ws2_32.dll" and process.code_signature.subject_name in ("Azul Systems, Inc.", "Ghisler Software GmbH", "Cellebrite DI LTD", "Pagebites, Inc.")) and
not (process.Ext.api.name in ("NtQueueApcThread", "OpenProcess", "ResumeThread") and process.code_signature.subject_name in ("Azul Systems, Inc.", "Eclipse.org Foundation, Inc.")) and
not (process.executable : "C:\\AutoVue_Client\\jre\\bin\\javaw.exe" and process.code_signature.subject_name == "Oracle America, Inc.") and
not (process.executable : "?:\\Users\\*\\AppData\\Local\\Turbo.net\\Sandbox\\GEARView\\*\\GEARViewBasic.exe" and
not (process.executable : ("?:\\Users\\*\\AppData\\Local\\Turbo.net\\Sandbox\\GEARView\\*\\GEARViewBasic.exe",
"\\\\?\\Volume{*}\\VMS_PortableClient_x64\\local\\stubexe\\*\\VMS_Client.exe") and
process.code_signature.subject_name == "Code Systems Corporation") and
not process.executable :
("?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
@@ -55,7 +56,11 @@ any where
"?:\\Windows\\FireEye\\AppMonitorDll*.dll*",
"?:\\Windows\\apppatch\\AppPatch*\\exploitblocker.dll*",
"?:\\windows\\system32\\hmpalert.dll!*")) and
process.thread.Ext.call_stack_final_user_module.hash.sha256 != "234360be58be376a77169fcc447cf8cbcba959f5c1db256ea2a50eeb92e65f44"
not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
("234360be58be376a77169fcc447cf8cbcba959f5c1db256ea2a50eeb92e65f44",
"fcdde72cfb1b2ff1bf953b2ded03b74c7d7273fa7dcef282a594c2819b2c497c",
"f5071fb08095973d5499e50e6ac176a1bdc33d774ea61e0e3c82605d468e0045",
"0a32e883d669a5b9bbb7aecc1cee31623aa69950ca9e3fce9d5270caa6ae0f39")
'''
min_endpoint_version = "8.10.0"
behavior/rules/windows/defense_evasion_potential_evasion_with_hardware_breakpoints.toml
+5 -9
View File
@@ -9,19 +9,15 @@ license = "Elastic License v2"
name = "Potential Evasion with Hardware Breakpoints"
os_list = ["windows"]
reference = ["https://github.com/rad9800/hwbp4mw"]
version = "1.0.15"
version = "1.0.16"
query = '''
any where process.thread.Ext.hardware_breakpoint_set == true and process.executable != null and
(
event.category == "api" or
(event.category == "library" and
library where process.thread.Ext.hardware_breakpoint_set == true and process.executable != null and
dll.name : ("wininet.dll", "ws2_32.dll", "dnsapi.dll", "winhttp.dll", "clr.dll", "netapi32.dll",
"mscorwks.dll", "System.*.dll", "mscorlib*.dll", "Microsoft.PowerShell.Security*.dll",
"Microsoft.PowerShell.ConsoleHost*.dll", "wmiutils.dll", "fastprox.dll", "wbemprox.dll",
"vaultcli.dll", "taskschd.dll", "dsquery.dll", "mstscax.dll", "ntdll.dll", "wldap32.dll",
"wtsapi32.dll", "psapi.dll"))
) and
"wtsapi32.dll", "psapi.dll") and
not (process.code_signature.trusted == true and
process.code_signature.subject_name :
("Riot Games, Inc.", "Roblox Corporation", "ROBLOX CORPORATION", "Intelligent Security Systems Corporation",
@@ -61,13 +57,13 @@ any where process.thread.Ext.hardware_breakpoint_set == true and process.executa
"\\Device\\HarddiskVolume4\\Program Files (x86)\\WeGame\\tenprotect\\TASLogin.exe",
"C:\\Program Files (x86)\\Hunter\\Aligner\\Execute\\aligner.exe",
"D:\\Program Files (x86)\\NWPS\\SwitchPortMapper\\spmap.exe") and
not process.parent.executable : "C:\\Program Files (x86)\\Microsoft Games\\Age of Empires III\\age3y.exe" and
not (process.executable : "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" and dll.name == "ws2_32.dll" and
process.thread.Ext.call_stack_summary == "Unbacked" and
_arraysearch(process.thread.Ext.call_stack, $entry,
$entry.callsite_trailing_bytes == "c3cd2ec30f1f84000000000000000000000000000000000000000000000000000000000000000000000000004c8bd1b82a000000f604250803fe7f0175030f05")) and
not (endswith~(process.thread.Ext.call_stack_summary, concat("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|", process.name)) and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection : "RWX" and $entry.allocation_private_bytes >= 100000 and stringcontains~($entry.symbol_info, process.name)))
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection : "RWX" and $entry.allocation_private_bytes >= 100000 and stringcontains~($entry.symbol_info, process.name))) and
not (dll.name : "wininet.dll" and process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|sscprot.dll|ntdll.dll|kernelbase.dll|combase.dll|shellhelper32.dll|calipermtxf.dll")
'''
min_endpoint_version = "8.11.0"
behavior/rules/windows/defense_evasion_potential_masquerading_as_svchost.toml
+2 -3
View File
@@ -11,7 +11,7 @@ reference = [
"https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
"https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four",
]
version = "1.0.36"
version = "1.0.37"
query = '''
process where event.action == "start" and
@@ -66,8 +66,7 @@ process where event.action == "start" and
not (process.pe.original_file_name == "AsDVDLock.exe" and
process.executable : "?:\\Program Files (x86)\\ASUS\\ASUS Manager\\USB Lock\\svchost.exe") and
not (process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.executable : "?:\\Windows\\System32\\svchost.exe") and
not (process.executable : ("?:\\WINDOWS\\system32\\msres\\svchost.exe", "?:\\WINDOWS\\syswow64\\msres\\svchost.exe") and
process.code_signature.subject_name : "SyncFuture Software Company Limited" and process.code_signature.trusted == true)
not (process.code_signature.subject_name : ("SyncFuture Software Company Limited", "Code Systems Corporation") and process.code_signature.trusted == true)
'''
min_endpoint_version = "7.15.0"
behavior/rules/windows/defense_evasion_potential_masquerading_as_windows_error_manager.toml
+2 -1
View File
@@ -13,7 +13,7 @@ reference = [
"https://www.elastic.co/security-labs/revisiting-blister-new-developments-of-the-blister-loader",
"https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
]
version = "1.0.27"
version = "1.0.28"
query = '''
process where event.action == "start" and
@@ -57,6 +57,7 @@ process where event.action == "start" and
"ntdll.dll|kernelbase.dll|hmpalert.dll|kernelbase.dll|kernel32.dll|werfault.exe|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|kernel32.dll|appxdeploymentserver.dll|svchost.exe|sechost.dll|kernel32.dll|ntdll.dll",
"sysfer.dll|kernelbase.dll|kernel32.dll|appxupgrademigrationplugin.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|kernel32.dll|appxdeploymentserver.dll|ntdll.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|kernel32.dll|Unknown|cbscore.dll|wcp.dll|ucrtbase.dll|wcp.dll|ntdll.dll|wcp.dll|cbscore.dll|tiworker.exe|rpcrt4.dll|combase.dll|rpcrt4.dll|combase.dll|rpcrt4.dll") and
not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "488945???88b4d*") and
not _arraysearch(process.parent.thread.Ext.call_stack, $entry,
behavior/rules/windows/defense_evasion_potential_shellcode_injection_via_clr.toml
+2 -1
View File
@@ -7,7 +7,7 @@ id = "1370f164-1809-4668-ad6c-dbf5bd278120"
license = "Elastic License v2"
name = "Potential Shellcode Injection via CLR"
os_list = ["windows"]
version = "1.0.8"
version = "1.0.9"
query = '''
api where
@@ -73,6 +73,7 @@ api where
"c2140090b851000000ba5091*77ffd2c2140090b852000700ba509*",
"883c438c3cccccc8954241048894c24084883ec28488b4c24*",
"41c644240c0148ba48202f12f87f0000833a00740c48b9f8292f12f87f0000ff118bf0e816b4ed5e85f60f95c00fb6c00fb6c041c644240c01488b5588498954",
"41c644240c01*85f60f95c00fb6c00fb6c041c644240c01488b55884989542410488d65c85b5e5f415c41",
"8bf04785f674a48bc65f5e5b8be55dc385f675f353ff75f8ff75f46a00ff150c07840a5f5e5b8be55dc3558beca11c45290b83ec2456578bfa85c075368d45dc",
"8d4c2410e8ba2cb2ff8b8c240c0100008bc75f5e33cce824b020028be55dc3cccccccc558bec83ec18a1fc55310b33c58945f8538b5d18568b7508578bf983fa",
"85c00f848f000000ff15f2a3cc0a3d332700000f859f000000488bb698000000488d7e78488d15d8264f0a4c8d059a284f0a488d5c24304889d941b9d2000000",
behavior/rules/windows/defense_evasion_potential_suspended_process_code_injection.toml
+3 -3
View File
@@ -7,7 +7,7 @@ id = "47167118-ba42-48e8-8555-dd50d98d21c4"
license = "Elastic License v2"
name = "Potential Suspended Process Code Injection"
os_list = ["windows"]
version = "1.0.13"
version = "1.0.14"
query = '''
api where process.Ext.api.name == "WriteProcessMemory" and
@@ -42,8 +42,8 @@ api where process.Ext.api.name == "WriteProcessMemory" and
/* bash and gbp */
not (process.Ext.api.metadata.target_address_name like ("Data", "msys-*", "cyg*.dll") and
process.thread.Ext.call_stack_summary like
("ntdll.dll|kernelbase.dll|msys-?.?.dll|Unknown",
"ntdll.dll|kernelbase.dll|cygwin?.dll|Unknown",
("ntdll.dll|kernelbase.dll|msys-?.?.dll|*Unknown",
"ntdll.dll|kernelbase.dll|cygwin?.dll|*Unknown",
"ntdll.dll|kernelbase.dll|cygwin?.dll|bash.exe",
"ntdll.dll|kernelbase.dll|cygwin?.dll",
"ntdll.dll|kernelbase.dll|msys-?.0.dll")) and
behavior/rules/windows/defense_evasion_process_creation_with_unusual_mitigation.toml
+3 -5
View File
@@ -11,7 +11,7 @@ reference = [
"https://blog.xpnsec.com/protecting-your-malware/",
"https://www.elastic.co/security-labs/pikabot-i-choose-you",
]
version = "1.0.18"
version = "1.0.19"
query = '''
process where event.type == "start" and process.executable != null and
@@ -39,10 +39,8 @@ process where event.type == "start" and process.executable != null and
not (process.code_signature.subject_name : ("Microsoft Windows Defender Advanced Threat Protection", "Wavesor Software (Eightpoint Technologies Ltd. SEZC)") and
process.code_signature.status : "trusted" and process.Ext.token.integrity_level_name : "system") and
not (process.parent.executable : "?:\\Windows\\System32\\hv*.exe" and process.executable : "?:\\Windows\\System32\\hv*.exe") and
not (process.executable : "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE??\\AI\\ai.exe" and
process.parent.executable : "C:\\Program Files\\Microsoft Office\\root\\Office??\\WINWORD.EXE") and
not (process.executable : "C:\\Program Files (x86)\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE??\\AI\\ai.exe" and
process.parent.executable : "C:\\Program Files (x86)\\Microsoft Office\\root\\Office??\\WINWORD.EXE") and
not (process.executable : "?:\\Program Files\\Microsoft Office\\root\\vfs\\*\\AI\\ai.exe" and process.parent.executable : "?:\\Program Files\\Microsoft Office\\*.EXE") and
not (process.executable : "?:\\Program Files (x86)\\Microsoft Office\\*\\AI\\ai.exe" and process.parent.executable : "?:\\Program Files (x86)\\Microsoft Office\\*.EXE") and
not (process.parent.executable : "?:\\Windows\\System32\\browser_broker.exe" and process.executable : "?:\\Windows\\System32\\browser_broker.exe") and
not (process.executable : "?:\\Windows\\System32\\vmwp.exe" and process.parent.executable : "?:\\Windows\\System32\\vmcompute.exe") and
not (process.parent.executable : "?:\\Windows\\System32\\lsass.exe" and process.executable : "?:\\Windows\\system32\\lsass.exe" and
behavior/rules/windows/defense_evasion_process_explorer_device_access_by_unusual_process.toml
+3 -1
View File
@@ -7,7 +7,7 @@ id = "9c4bd6d6-9e2f-4ce2-8266-923e1799726c"
license = "Elastic License v2"
name = "Process Explorer Device Access by Unusual Process"
os_list = ["windows"]
version = "1.0.5"
version = "1.0.6"
query = '''
api where
@@ -21,7 +21,9 @@ api where
process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Undetermined") and process.code_signature.trusted == true) and
not (process.thread.Ext.call_stack_final_user_module.name : ("procexp64.exe", "procexp.exe", "handle64.exe") and
process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) and
not (process.name : ("handle64.exe", "handle.exe") and process.command_line : "* -accepteula *" and process.thread.Ext.call_stack_final_user_module.name == "Unknown") and
not process.thread.Ext.call_stack_final_user_module.path : "c:\\windows\\system32\\apphelp.dll" and
not (process.executable : "C:\\Windows\\Temp\\Handle64.exe" and process.parent.executable : "C:\\Windows\\_ScriptingFramework\\Tools\\handle.exe") and
not (process.Ext.api.parameters.device == "\\Device\\PROCEXP152" and process.thread.Ext.call_stack_final_user_module.name == "handle64.exe") and
not (process.executable : "C:\\Windows\\System32\\svchost.exe" and process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\iphlpsvc.dll")
'''
behavior/rules/windows/defense_evasion_remote_file_execution_via_msiexec.toml
+2 -2
View File
@@ -13,7 +13,7 @@ reference = [
"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
"https://www.guardicore.com/labs/purple-fox-rootkit-now-propagates-as-a-worm/",
]
version = "1.0.44"
version = "1.0.45"
query = '''
sequence with maxspan=1m
@@ -61,7 +61,7 @@ not process.args :
"C:\\Program Files (x86)\\ManageEngine\\UEMS_DistributionServer\\\\Updates\\UEMSDistributionServer.msi",
"https://awscli.amazonaws.com/AWSCLIV2.msi",
"SERVERURL=https://*.apparmor.com",
"INSTALLARGS=--url=https://*.fleet.us-east-2.aws.elastic-cloud.com:443",
"INSTALLARGS=--url=https://*.fleet.us-east-2.aws.elastic-cloud.com:443*",
"https://cdn.zabbix.com/zabbix/binaries/stable/*.msi",
"INSTALLARGS=--url=https://fleet.*--enrollment-token=*") and
not process.parent.executable :
behavior/rules/windows/defense_evasion_remote_memory_write_to_trusted_target_process.toml
+4 -3
View File
@@ -7,7 +7,7 @@ id = "5c6c166c-a894-4263-918a-c7632014a486"
license = "Elastic License v2"
name = "Remote Memory Write to Trusted Target Process"
os_list = ["windows"]
version = "1.0.8"
version = "1.0.9"
query = '''
api where process.Ext.api.name == "WriteProcessMemory" and
@@ -21,7 +21,7 @@ api where process.Ext.api.name == "WriteProcessMemory" and
Target.process.executable : ("?:\\Windows\\*", "?:\\Program Files*") and
/* WPM triggers multiple times at process creation */
not (_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "*\\kernelbase.dll!CreateProcess*")
not (_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("*\\kernelbase.dll!CreateProcess*", "*\\kernelbase.dll+0x*"))
and process.Ext.api.summary like ("*PEB*", "*PEB32*", "*ProcessStartupInfo*")) and
not (process.Ext.api.summary like ("*PEB*", "*PEB32*", "*ProcessStartupInfo*") and
@@ -215,7 +215,8 @@ not (process.name : "rundll32.exe" and process.Ext.api.parameters.size <= 140 an
"11d174e1e922a8e644bdd2b5287879445cc6ff0117ef553d5ce6390f1bb49cb5",
"69a56fd6a22193044336b1ee6548efcc992ab3e51f617d772a32f5e12cdef998",
"d1c43b02455df6ed98a5c1fe1ac16284706ed4bd76a784c332dd6b2bec90183f",
"ff31fa811f9c07cc7fdaa68c9e8bca3a7b4fdf6e0a079a58175ea58ba139c7ae") and
"ff31fa811f9c07cc7fdaa68c9e8bca3a7b4fdf6e0a079a58175ea58ba139c7ae",
"25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd") and
not (process.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio*\\bin\\lib.exe" and
Target.process.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio*.exe" and process.thread.Ext.call_stack_final_user_module.name == "qt5xml.dll")
'''
behavior/rules/windows/defense_evasion_remote_process_memory_write_by_low_reputation_module.toml
+5 -2
View File
@@ -7,7 +7,7 @@ id = "54916896-1f73-441d-acec-1141094b15e3"
license = "Elastic License v2"
name = "Remote Process Memory Write by Low Reputation Module"
os_list = ["windows"]
version = "1.0.4"
version = "1.0.5"
query = '''
api where process.Ext.api.name == "WriteProcessMemory" and
@@ -158,7 +158,10 @@ api where process.Ext.api.name == "WriteProcessMemory" and
"55cf1d3e49027092e6a364cc11b0a33bf3ca829868842067b9468a4b3f7a9c54",
"89b8da24841c9959a19bb7932c02476b5150c4b17303f79b1252bee12559d419",
"0274eae9163aa1e5184ec44959bc052dc58a090b4d27923ed64aa985b3e8ea82",
"084b788ef2f160822ffd140665ea1d6065fe04bf0fbc85da2314e8baa630b282")
"084b788ef2f160822ffd140665ea1d6065fe04bf0fbc85da2314e8baa630b282",
"7998b2da82bac8bbcfbbcd73e0c439d780776e63889dd77b07ad11855416d789",
"c0ebdc88e948ce980fcd1ea7d984b8a27539b34cc22f38bf477f19f42f206bac",
"f939f09133e4a6a050e085adcdebadc92a45bd8696d75895ea520cfbd0167ebe")
'''
min_endpoint_version = "8.14.2"
behavior/rules/windows/defense_evasion_rundll32_or_regsvr32_loaded_a_dll_from_unbacked_memory.toml
+3 -2
View File
@@ -11,7 +11,7 @@ reference = [
"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
"https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.25"
version = "1.0.26"
query = '''
sequence by process.entity_id
@@ -31,7 +31,8 @@ sequence by process.entity_id
("?:\\Program Files\\Royal TS V6\\RoyalTS.exe",
"?:\\Program Files (x86)\\Kaarya LLC\\myKaarma Desktop\\KaarmaDesktop.exe",
"?:\\Program Files (x86)\\Steam\\steamapps\\common\\Sun Haven\\Sun Haven.exe",
"?:\\Program Files\\Symantec\\Symantec Endpoint Protection\\*\\Bin64\\ccSvcHst.exe") and
"?:\\Program Files\\Symantec\\Symantec Endpoint Protection\\*\\Bin64\\ccSvcHst.exe",
"?:\\Program Files (x86)\\VCOM\\VcomConsole.exe") and
not (process.args : "--zoam=IndexCigar\\license.dat" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
not (process.name : "rundll32.exe" and
behavior/rules/windows/defense_evasion_script_execution_via_microsoft_html_application.toml
+4 -2
View File
@@ -7,7 +7,7 @@ id = "f0630213-c4c4-4898-9514-746395eb9962"
license = "Elastic License v2"
name = "Script Execution via Microsoft HTML Application"
os_list = ["windows"]
version = "1.0.36"
version = "1.0.37"
query = '''
process where event.action == "start" and
@@ -60,7 +60,9 @@ process where event.action == "start" and
/* FPs */
not (process.parent.executable : "C:\\Windows\\SysWOW64\\runonce.exe" and
process.args : "\"& 'C:\\System.sav\\util\\HpseuHostLauncher.ps1'\"\", 0 : window.close)") and
not (process.name : "mshta.exe" and process.args : "\"& '\\\\*\\Support\\AzureVirtualDesktop\\ImageSources\\DisableTeamsAutoStart.ps1'\"\", 0 : window.close)") and
not (process.name : "mshta.exe" and
process.args : ("*\\Support\\AzureVirtualDesktop\\ImageSources\\DisableTeamsAutoStart.ps1*",
"*C:\\Program Files (x86)\\combit\\*\\ServicePackNotification.ps1*")) and
not process.command_line : ("*encodeURIComponent*", "*.Popup*", "*C:\\PROGRA~2*", "*\\Downloads\\download*.hta*", "*Readme_he-IL.hta*", "*cisco-secure-client-win*") and
not (process.parent.name : "cmd.exe" and process.name : "mshta.exe" and process.args : "D:\\start.hta") and
not (process.name : "mshta.exe" and process.parent.executable : "C:\\Windows\\SysWOW64\\cmd.exe" and
behavior/rules/windows/defense_evasion_shellcode_execution_from_low_reputation_module.toml
+4 -2
View File
@@ -8,7 +8,7 @@ reference = [
"https://www.elastic.co/security-labs/pikabot-i-choose-you",
"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
]
version = "1.0.18"
version = "1.0.19"
query = '''
sequence by process.entity_id with maxspan=1m
@@ -75,7 +75,9 @@ sequence by process.entity_id with maxspan=1m
"ce12e654c48a7145f456ded3337354227c845c4012a6302fa63e6901c580b610",
"05b5616932031283eea3751dfcad273db805a71b4e35afdbc03bd3c30bc6b6b0",
"f5924d522b7d8b4a551c2d4045069c9a711b62b97e2b799e7b42a9931e58fba3",
"0cd9e13dbce7595879d9e972dc04e81da63d1cbf34c99fd3603e2aba68ccf2a5") and
"0cd9e13dbce7595879d9e972dc04e81da63d1cbf34c99fd3603e2aba68ccf2a5",
"f6b9cefd13932daad90ac587fec1e5ec542bca1936fcbd3245d0919e48460a9c",
"c14d07ccccaaab6c4adbfba16b3f977f64408499dce5aa8df424b2c59a313d48") and
not (process.executable : "?:\\Windows\\Sys*\\msiexec.exe" and dll.path : "C:\\Windows\\Installer\\MSI????.tmp")] by dll.hash.sha256
[api where
process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
behavior/rules/windows/defense_evasion_suspicious_api_call_via_a_windows_installer_module.toml
+5 -3
View File
@@ -7,7 +7,7 @@ id = "43e9d254-28e9-463d-9bc3-5e51721d4b8a"
license = "Elastic License v2"
name = "Suspicious API call via a Windows Installer Module"
os_list = ["windows"]
version = "1.0.6"
version = "1.0.7"
query = '''
api where process.name : "msiexec.exe" and
@@ -34,8 +34,10 @@ api where process.name : "msiexec.exe" and
("85da69c82e3d1faff1e60e6853e30230fc5e3b64faf4245e20089fe75912d910",
"09e957a1d31b9cf8666add20613bf60b6a2d294586f8887961cc6a0e24680fb8",
"3c60786fddc7fb00b2dab7bd2b6c33340e07c73ea8e3d6c47754bb9d15d83166",
/* TBR - Kaspersky standalone_updater */
"0c9891da5c64a519c11e7603a41e93e0ff3057cca238ee59ffb5b4a82985011a")
/* Kaspersky */
"0c9891da5c64a519c11e7603a41e93e0ff3057cca238ee59ffb5b4a82985011a",
"80f84a7b8aad0bdceba677e6a501f71b6b57878e34b6b557e1892083a32b7bd5",
"0297e306edf0a868e1edffa4de158906142f131b550061a7d68cca721482a953")
'''
min_endpoint_version = "8.10.0"
behavior/rules/windows/defense_evasion_suspicious_appdomain_manager_configuration_file.toml
+3 -2
View File
@@ -12,7 +12,7 @@ reference = [
"https://www.rapid7.com/blog/post/2023/05/05/appdomain-manager-injection-new-techniques-for-red-teams/",
"https://github.com/netbiosX/GhostLoader/tree/master",
]
version = "1.0.9"
version = "1.0.10"
query = '''
sequence with maxspan=5m
@@ -46,7 +46,8 @@ sequence with maxspan=5m
"?:\\Windows\\System32\\regsvr32.exe") and
not dll.hash.sha256 : ("4810a7b50ffb5e044ac64432b7fcfe4795cc4c6494e1d7f25f9f9cfe388d2ea6",
"9a5294182e611ccdae9962d2e26a84c3287cd18409b4985d468055b690d9134c",
"506e3d9184a6c08ae75c1bb7f3d72901ff6eeade3f6ed06237de878276f9fed7") and
"506e3d9184a6c08ae75c1bb7f3d72901ff6eeade3f6ed06237de878276f9fed7",
"eb0153d13e522520015d09e679618b4cc61bd43d0fcd402922b6507daf706edc") and
not (process.code_signature.subject_name : "Volvo Car Corporation" and process.code_signature.trusted == true)
]
'''
behavior/rules/windows/defense_evasion_suspicious_execution_from_an_oversized_executable.toml
+5 -2
View File
@@ -9,7 +9,7 @@ license = "Elastic License v2"
name = "Suspicious Execution from an Oversized Executable"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1027/001/"]
version = "1.0.5"
version = "1.0.6"
query = '''
sequence with maxspan=5m
@@ -57,7 +57,10 @@ sequence with maxspan=5m
"cmd /c dir") and
not (process.name : "cmd.exe" and process.args : ("*.bat", "*.cmd", "rmdir", "*.bat ", "*.cmd ")) and
not (process.name : "cmd.exe" and process.args : ("*reg.exe QUERY*", "netstat -r", "net session", "wsl.exe -l -q",
"C:\\Program Files (x86)\\Annke Vision Site\\Nginx")) and
"C:\\Program Files (x86)\\Annke Vision Site\\Nginx",
"route print 0.0.0.0 mask 0.0.0.0",
"powershell -command Get-Culture",
"powershell -Command Get-Host")) and
not (process.name : "powershell.exe" and
process.command_line : "C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -")
] by process.parent.executable
behavior/rules/windows/defense_evasion_suspicious_msiexec_child_process.toml
+4 -3
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Suspicious MsiExec Child Process"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"]
version = "1.0.30"
version = "1.0.31"
query = '''
process where event.action == "start" and
@@ -79,8 +79,9 @@ process where event.action == "start" and
"3f59a2799dc6aa6cdddbc62e169fad7e7dd282bffba3538ed2594e3a8d6c1a05",
"54b1f519d64469ffcb2c9f417dc9b46e16f44a19522236122741a9df7a877f0a",
"ec4a6b16df94b1c78b48796d7f624fc19253140569ccb51dfb7f6771d2b0e53d",
"0f727129cd58c2291dbccac8930ad80c28b6d19ebfa4c5f91deb4c00b7c75774") and
not (process.name : "rundll32.exe" and process.args : ("printui.dll,PrintUIEntry", "C:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper32.dll,#1")) and
"0f727129cd58c2291dbccac8930ad80c28b6d19ebfa4c5f91deb4c00b7c75774",
"2aee9f92793ccd46579951e44dc8793045b50e1c23824681a64f653bdae58973") and
not (process.name : "rundll32.exe" and process.args : ("printui.dll,PrintUIEntry", "C:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper??.dll,#1")) and
not (process.name : "regsvr32.exe" and process.args : "?:\\ProgramData\\LEAP Office\\Cloud\\Extras\\Automation Extras\\LEAPRedemption64.dll") and
not (process.name : "cmd.exe" and process.args : "del" and process.args : "/f") and
not (process.name : "cmd.exe" and process.args : "C:\\Program") and
behavior/rules/windows/defense_evasion_suspicious_remote_process_suspend_activity.toml
+5 -2
View File
@@ -8,7 +8,7 @@ id = "9e533f20-733e-4d71-bbe5-2ab5939aaf57"
license = "Elastic License v2"
name = "Suspicious Remote Process Suspend Activity"
os_list = ["windows"]
version = "1.0.17"
version = "1.0.18"
query = '''
api where process.Ext.api.name in ("NtSuspendProcess", "SuspendThread") and process.executable != null and
@@ -155,7 +155,10 @@ api where process.Ext.api.name in ("NtSuspendProcess", "SuspendThread") and proc
"1d403006ac76665391a294578678f23634d5699525ecc589fad808cbf8284030",
"70adb308b63b5f02126672cd6d89d830c47b19d1c48d55a13cb4f530a4716e6a",
"a3272147ae66166bc1edf8fac3e245e7ab8a2f882efaa52ba6679f96faec5545",
"e9b488ad3101d386a3b2248db0c0dfe43c83fd856c55d181264da762f5352f38") and
"e9b488ad3101d386a3b2248db0c0dfe43c83fd856c55d181264da762f5352f38",
"bd9b92d3dd1c5d6ba06d0aa3216c74a293510a8807eaecd756c01edbd650825e",
"d0cc0a62b6640f6284e4481dfda62ab2a6f488a483c38a54f218653fec7b47e9",
"3c1b985c6a707733b4a93213e8178509366d29b1f2201790b625599d0696966c") and
not (process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\SysWOW64\\WerFault.exe") and
process.thread.Ext.call_stack_final_user_module.path : ("?:\\windows\\*", "?:\\program files (x86)\\*", "?:\\program files\\*")) and
behavior/rules/windows/defense_evasion_unbacked_shellcode_from_unsigned_module.toml
+3 -2
View File
@@ -8,7 +8,7 @@ reference = [
"https://www.elastic.co/security-labs/pikabot-i-choose-you",
"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
]
version = "1.0.10"
version = "1.0.11"
query = '''
api where
@@ -101,7 +101,8 @@ api where
"965162abde211f72c80062b1799eb4385d3e9322c4b38b8da9dc718a769570b7",
"d355b62cc7dc5b8f3ee5e95a8ddddc818f6f84c5a16799d78b1cb3d786e2bb80",
"765bf93c500ca73d73a5ba790f7c1675ff6ffdc7c54ee03dafca69ee701f5cfe",
"eee4d4620d56c8c0212437b184444e1fe74e29d6d018d69750e52b27e9eba46b") and
"eee4d4620d56c8c0212437b184444e1fe74e29d6d018d69750e52b27e9eba46b",
"f939f09133e4a6a050e085adcdebadc92a45bd8696d75895ea520cfbd0167ebe") and
not process.thread.Ext.call_stack_final_user_module.protection_provenance in ("isrt.dll", "issetup.dll", "dbexpida.dll", "cyinjct.dll", "_isres.dll", "bass.dll") and
not (process.executable : "C:\\Windows\\SysWOW64\\msiexec.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance like ("msi*.tmp", "_isres.dll", "itcombo6.ocx")) and
not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like
behavior/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml
+2 -5
View File
@@ -7,7 +7,7 @@ id = "2e708541-c6e8-4ded-923f-78a6c160987e"
license = "Elastic License v2"
name = "Unusual Network Connection via RunDLL32"
os_list = ["windows"]
version = "1.0.33"
version = "1.0.34"
query = '''
sequence by process.entity_id with maxspan=5m
@@ -15,10 +15,7 @@ sequence by process.entity_id with maxspan=5m
not (process.code_signature.subject_name == "Teramind Inc." and
process.code_signature.trusted == true and process.Ext.token.integrity_level_name == "system" and
process.args == "/update" and process.parent.name == "tmagentsvc.exe") and
not process.args :
("C:\\Windows\\system32\\rundll32.exe C:\\Windows\\system32\\PcaSvc.dll,PcaPatchSdbTask",
"C:\\Windows\\System32\\rundll32.exe C:\\Windows\\System32\\LogiLDA.dll,LogiFetch",
"C:\\windows\\system32\\rundll32.exe cryptext.dll,CryptExtOpenCAT *")]
not process.args : "C:\\Windows\\system32\\rundll32.exe *,*"]
[network where event.action == "connection_attempted" and process.name : "rundll32.exe"]
'''
behavior/rules/windows/defense_evasion_windows_api_call_via_indirect_random_syscall.toml
+4 -2
View File
@@ -7,7 +7,7 @@ id = "9bc5d4cd-5748-4425-a4f3-7a704a11029d"
license = "Elastic License v2"
name = "Windows API Call via Indirect Random Syscall"
os_list = ["windows"]
version = "1.0.7"
version = "1.0.8"
query = '''
api where
@@ -96,7 +96,9 @@ api where
"*\\kernelbase.dll!AddExtensionProgId*",
"*\\ntdll.dll!NtAllocateReserveObject*",
"*\\ntdll.dll!ZwRestoreKey*",
"*\\kernelbase.dll!ProcessIdToSessionId*")) and
"*\\kernelbase.dll!ProcessIdToSessionId*",
"c:\\windows\\system32\\ntdll.dll!NtOpenSection*",
"c:\\windows\\system32\\ntdll.dll!NtImpersonateClientOfPort*")) and
not (process.thread.Ext.call_stack_summary : "ntdll.dll|Unknown|ntdll.dll*" and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "*ntdll.dll!*TestAlert*")) and
behavior/rules/windows/defense_evasion_windows_console_execution_from_unbacked_memory.toml
+6 -4
View File
@@ -11,7 +11,7 @@ os_list = ["windows"]
reference = [
"https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.21"
version = "1.0.22"
query = '''
sequence with maxspan=5m
@@ -33,8 +33,8 @@ sequence with maxspan=5m
"I:\\RSA\\Microsoft Azure Recovery Services Agent\\bin\\cbengine.exe",
"C:\\Drivers\\Nord\\NordSec ThreatProtection\\nordsec-threatprotection-service.exe")) and
not (process.parent.executable : "?:\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe" and user.id : "S-1-5-18" and
process.code_signature.trusted == true) and
not (process.code_signature.subject_name : "ProVation Medical" and process.code_signature.trusted == true) and
process.code_signature.trusted == true) and
not (process.code_signature.subject_name : "ProVation Medical" and process.code_signature.trusted == true) and
not process.parent.executable :
("?:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\*\\gc_service.exe",
"?:\\Windows\\System32\\wsmprovhost.exe",
@@ -82,11 +82,13 @@ sequence with maxspan=5m
"C:\\Program Files (x86)\\Chocolatey GUI\\ChocolateyGui.exe",
"C:\\Program Files\\Royal TS V7\\RoyalTS.exe",
"C:\\Program Files\\QSR\\NVivo ??\\NVivo.exe",
"C:\\Program Files\\Password Safe and Repository*\\PSRServer.exe") and
"C:\\Program Files\\Password Safe and Repository*\\PSRServer.exe",
"C:\\Program Files\\WindowsApps\\Microsoft.GetHelp_*\\GetHelp.exe") and
not _arraysearch(process.parent.thread.Ext.call_stack, $entry,
$entry.callsite_trailing_bytes :
("c6460c01833d*e85ff0f95c00fb6c00fb6c0c6460c01488b559048895610488d65c85b5e5f415c415d415e415f",
"*48895610488d65c85b5e5f415c415d415e415f5dc30000001910090010c20c300b60*",
"*95c00fb6c0488b5588488956104883c4785b5e5f415c41*",
"c6460c01833d9c8c755e007406ff15a495755e85c00f95c00fb6c00fb6c0c6460c01488b559048895610488d65c85b5e5f415c415d415e415f5dc31910090010"))
] by process.parent.entity_id
behavior/rules/windows/defense_evasion_windows_error_manager_reporting_masquerading.toml
+2 -2
View File
@@ -9,12 +9,12 @@ license = "Elastic License v2"
name = "Windows Error Manager/Reporting Masquerading"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/revisiting-blister-new-developments-of-the-blister-loader"]
version = "1.0.32"
version = "1.0.33"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
process.name : ("wermgr.exe", "WerFault.exe") and process.args_count == 1 and
process.name : ("wermgr.exe", "WerFault.exe") and process.args_count == 1 and process.parent.executable != null and
not (process.args : "C:\\WINDOWS\\system32\\wermgr.exe -upload" and process.parent.executable : "C:\\Windows\\System32\\svchost.exe")]
[network where event.action == "connection_attempted" and process.name : ("wermgr.exe", "WerFault.exe")]
'''
behavior/rules/windows/discovery_domain_accounts_enumeration_via_ldap_search.toml
+54
View File
@@ -0,0 +1,54 @@
[rule]
description = "Identifies a list of suspicious LDAP queries often used by reconnaissance tools to enumerate domain user accounts."
id = "c3b3cd2e-04f5-457f-8d69-f92468f22eae"
license = "Elastic License v2"
name = "Domain Accounts Enumeration via LDAP Search"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1087/002/"]
version = "1.0.2"
query = '''
api where process.Ext.api.name == "ldap_search" and not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
not process.executable :
("?:\\Program Files\\Azure Advanced Threat Protection Sensor\\*\\Microsoft.Tri.Sensor.exe",
"?:\\Windows\\ADFS\\Microsoft.IdentityServer.ServiceHost.exe") and
process.Ext.api.parameters.search_filter : (
"(&(samAccountType=805306368)(samAccountName=?)",
"(&(objectCategory=person)(lastLogon>=*",
"(&(objectCategory=person)(objectClass=user)(lastLogon>=*",
"(&(objectCategory=person)(objectClass=user)(directReports=?)(!(manager=?)))"
)
'''
min_endpoint_version = "9.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[threat.technique.subtechnique]]
id = "T1087.002"
name = "Domain Account"
reference = "https://attack.mitre.org/techniques/T1087/002/"
[[threat.technique]]
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "9.1.0"
behavior/rules/windows/discovery_potential_browser_information_discovery.toml
+3 -1
View File
@@ -8,7 +8,7 @@ license = "Elastic License v2"
name = "Potential Browser Information Discovery"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1217/"]
version = "1.0.11"
version = "1.0.12"
query = '''
file where event.action == "open" and
@@ -46,6 +46,8 @@ process.executable != null and not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20
"?:\\Users\\*\\User Data\\Default\\msedge_downloads.exe",
"?:\\Users\\*\\AppData\\Local\\Chromium\\Application\\chrome.exe",
"?:\\Users\\*\\AppData\\Local\\Thorium\\Application\\thorium.exe") and
not (process.executable : "C:\\Windows\\Temp\\RarSFX*\\scanstate.exe" and
process.thread.Ext.call_stack_summary == "ntdll.dll|sophosed.dll|apphelp.dll|kernelbase.dll|migcore.dll|migstore.dll|migcore.dll|scanstate.exe|kernel32.dll|ntdll.dll") and
not (process.executable : "C:\\Windows\\explorer.exe" and
process.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|hostshellextension.dll|Unbacked") and
not _arraysearch(process.thread.Ext.call_stack, $entry,
behavior/rules/windows/discovery_suspicious_security_product_enumeration.toml
+2 -1
View File
@@ -4,7 +4,7 @@ id = "8749c08b-58f5-4e7c-ab15-3551b7541f7a"
license = "Elastic License v2"
name = "Suspicious Security Product Enumeration"
os_list = ["windows"]
version = "1.0.14"
version = "1.0.15"
query = '''
api where
@@ -116,6 +116,7 @@ api where
"C:\\Program Files (x86)\\OSTotoSoft\\DriverTalent\\HardWareReport.exe",
"C:\\Windows\\System32\\UsoClient.exe",
"C:\\Windows\\CCM\\CcmExec.exe",
"C:\\Windows\\system32\\wsmprovhost.exe",
"\\Device\\Mup\\*.exe",
"C:\\Windows\\Microsoft.NET\\Framework64\\v4.*\\mscorsvw.exe",
"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.*\\MpCmdRun.exe",
behavior/rules/windows/execution_execution_from_unusual_directory.toml
+3 -2
View File
@@ -12,7 +12,7 @@ reference = [
"https://www.elastic.co/security-labs/hunting-for-lateral-movement-using-event-query-language",
"https://www.elastic.co/security-labs/operation-bleeding-bear",
]
version = "1.0.46"
version = "1.0.47"
query = '''
process where event.action == "start" and
@@ -136,7 +136,8 @@ process where event.action == "start" and
"?:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll,InstallVstoSolution",
"?:\\Program Files\\WIBU-SYSTEMS\\System\\WibuShellExt64.dll,OpenWbc",
"CopyTransHEICforWindows.dll,ConvertList",
"C:\\Program Files (x86)\\Common Files\\ADInstruments\\ADILauncher64.dll,")) and not
"C:\\Program Files (x86)\\Common Files\\ADInstruments\\ADILauncher64.dll,",
"C:\\Windows\\diagnostics\\system\\Printer\\UpdatePrinterDriver.dll,UpdatePrinterDriverEntry")) and not
/* MS Visual Studio */
process.executable : ("?:\\Program Files (x86)\\Microsoft Visual Studio\\*.exe", "?:\\Program Files (x86)\\Microsoft Visual Studio\\*.exe") and
behavior/rules/windows/execution_execution_via_wmi_followed_by_network_connection.toml
+2 -2
View File
@@ -7,7 +7,7 @@ id = "cf738466-9fff-44d9-8603-4a7e6e6c8d1f"
license = "Elastic License v2"
name = "Execution via WMI followed by Network Connection"
os_list = ["windows"]
version = "1.0.6"
version = "1.0.7"
query = '''
sequence with maxspan=5m
@@ -21,7 +21,7 @@ sequence with maxspan=5m
"0e8606ba02828d403e321e37f1568aa321a95d3bdbdb83b73583105b666d79ba") and
not (process.Ext.effective_parent.executable : "C:\\Windows\\System32\\inetsrv\\w3wp.exe" and
process.command_line : "C:\\Windows\\system32\\cmd.exe /c C:\\SysMgmt\\service\\mwtools\\SD_Installer_Start.cmd") and
not (process.code_signature.subject_name == "FUJITSU CLIENT COMPUTING LIMITED" and process.code_signature.trusted == true) and
not (process.code_signature.subject_name : ("FUJITSU CLIENT COMPUTING LIMITED", "Siemens AG") and process.code_signature.trusted == true) and
not process.Ext.effective_parent.executable :
("I:\\SCCM\\bin\\X64\\smsexec.exe",
"?:\\Program Files\\*.exe",
behavior/rules/windows/execution_java_application_execution_from_suspicious_paths.toml
+2 -2
View File
@@ -7,7 +7,7 @@ id = "b5d02713-e392-47c4-b38b-10b68dbc00a6"
license = "Elastic License v2"
name = "JAVA Application Execution from Suspicious Paths"
os_list = ["windows"]
version = "1.0.3"
version = "1.0.4"
query = '''
sequence by process.entity_id with maxspan=5s
@@ -26,7 +26,7 @@ sequence by process.entity_id with maxspan=5s
"192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
"192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
"100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
"FE80::/10", "FF00::/8", "129.153.192.0/19") and
"FE80::/10", "FF00::/8", "129.153.192.0/19", "128.194.0.0/16") and
not (process.executable : "C:\\Program Files\\Amazon Corretto\\jdk*\\bin\\javaw.exe" and destination.ip == "164.154.131.141") and
not (process.executable : "C:\\Program Files\\Zulu\\zulu-??\\bin\\javaw.exe" and destination.ip == "146.75.93.145")]
'''
behavior/rules/windows/execution_potential_command_and_control_via_windows_scripts.toml
+2 -2
View File
@@ -8,13 +8,13 @@ id = "3121956f-8c0b-40ef-b98d-7b7b0ab02d2e"
license = "Elastic License v2"
name = "Potential Command and Control via Windows Scripts"
os_list = ["windows"]
version = "1.0.9"
version = "1.0.10"
query = '''
sequence by process.entity_id
[process where event.action == "start" and
process.pe.original_file_name : ("wscript.exe", "AutoIt*.exe") and
not process.Ext.token.integrity_level_name == "system"]
not process.Ext.token.integrity_level_name == "system" and not process.args : "\\\\*\\netlogon\\*.vbs"]
[network where
event.action == "connection_attempted" and network.direction == "egress" and network.transport == "tcp" and
process.uptime >= 300 and source.port >= 49152 and
behavior/rules/windows/execution_suspicious_api_call_from_a_powershell_script.toml
+34 -12
View File
@@ -4,7 +4,7 @@ id = "6ad0c702-ddf0-4631-ac43-37eeea444ee6"
license = "Elastic License v2"
name = "Suspicious API Call from a PowerShell Script"
os_list = ["windows"]
version = "1.0.18"
version = "1.0.20"
query = '''
api where
@@ -30,18 +30,25 @@ not (
not (process.parent.executable : "C:\\Windows\\System32\\gpscript.exe" and
process.Ext.api.summary in ("VirtualProtect( Unbacked, 0x10, RWX, RW- )", "WriteProcessMemory( Self, Unbacked, 0x10 )", "WriteProcessMemory( Self, Data, 0x10 )")) and
/* cybersecurity tools */
/* cybersecurity and other tools */
not process.parent.executable :
("C:\\Program Files (x86)\\CyberCNSAgent\\cybercnsagent.exe",
"C:\\Program Files\\Velociraptor\\Velociraptor.exe",
"C:\\Program Files (x86)\\baramundi\\BMA\\BDSRun.exe",
"C:\\Program Files\\Huntress\\HuntressAgent.exe",
"C:\\Program Files (x86)\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe",
"C:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe",
"C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
"C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseCM.exe",
"C:\\Program Files (x86)\\ITSPlatform\\plugin\\*.exe",
"C:\\Program Files (x86)\\ACMPClient\\ACMPClientService.exe",
"C:\\Program Files\\SGN Connect\\*\\sgncore.exe") and
"C:\\Program Files\\SGN Connect\\*\\sgncore.exe",
"C:\\Program Files (x86)\\Msp Agent\\components\\*\\generic-asset-interrogator.exe",
"C:\\Program Files (x86)\\CyberCNSAgentV2\\cybercnsagentv2.exe",
"C:\\Program Files\\RevBits EPS\\RevBitsEPS.exe",
"C:\\Program Files (x86)\\Quest\\KACE\\KInventory.exe",
"C:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\*\\x64\\BGHelper.exe",
"C:\\Program Files\\PDQ\\PDQConnectAgent\\pdq-connect-agent.exe") and
/* module listing */
not (process.Ext.api.name in ("EnumProcessModules", "GetModuleInformation", "K32GetModuleBaseNameW", "K32GetModuleFileNameExW") and
@@ -62,19 +69,34 @@ not process.thread.Ext.call_stack_summary like
"ntdll.dll|bdhkm64.dll|atcuf64.dll|bdhkm64.dll|Unbacked|ntdll.dll|kernelbase.dll|bdhkm64.dll|Unbacked",
"ntdll.dll|bdhkm64.dll|Unbacked|ntdll.dll|kernelbase.dll|bdhkm64.dll|Unbacked",
"ntdll.dll|umppc*.dll|scriptcontrol64_*.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|protector32.dll|kernelbase.dll|protector32.dll|Unbacked") and
not process.parent.executable : ("C:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\*\\x64\\BGHelper.exe",
"C:\\Program Files\\PDQ\\PDQConnectAgent\\pdq-connect-agent.exe") and
"ntdll.dll|edrdotnet.unmanagedlib.???.dll|Unbacked",
"ntdll.dll|hmpalert.dll|advapi32.dll|Unknown",
"ntdll.dll|inprocessclient64.dll|kernelbase.dll|inprocessclient64.dll|Unknown",
"ntdll.dll|cyvrtrap.dll|edrdotnet.unmanagedlib.???.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|protector32.dll|kernelbase.dll|protector32.dll|Unbacked",
"ntdll.dll|umppc*.dll|bdhkm64.dll|atcuf64.dll|bdhkm64.dll|Unbacked*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|protector32.dll|kernelbase.dll|protector32.dll|Unbacked",
"ntdll.dll|minprocessclient.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|inprocessclient32.dll|kernelbase.dll|inprocessclient32.dll|Unbacked|clr.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|psninjhookms32.dll|Unbacked|psninjhookms32.dll|Unbacked|psninjhookms32.dll|Unbacked|clr.dll|clrjit.dll|clr.dll|Unbacked*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|dbgeng.dll|Unbacked|clr.dll|dbgeng.dll|mscorlib.ni.dll|clr.dll|powershell.exe|kernel32.dll|ntdll.dll") and
not _arraysearch(process.thread.Ext.call_stack, $entry,
$entry.callsite_trailing_bytes like ("41c644240c01*85f60f95c00fb6c00fb6c041c644240c01488b55884989542410488d65c85b5e5f415c41*",
"c6430c01*488d65c85b5e5f415c415d415e415f5dc3*",
"418845084d8bc5488bcf8bd3e8*b8010000004883c4285b5d5e5f415c415d415e415fc3*",
"*41c6470c01488b459049894710488d65c85b5e5f415c415d415e415f5dc30000001910090010*")) and
not (process.Ext.api.name == "VirtualProtect" and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*", "c:\\windows\\sys?????\\ntdll.dll!LdrGetDllHandle*"))) and
not (process.Ext.api.name == "VirtualAlloc" and
"418845084d8bc5488bcf8bd3e8*b8010000004883c4285b5d5e5f415c415d415e415fc3*",
"834648fab8010000004883c4685b5d5e5f415c415d415e415fc3*",
"488b95c0feffffc6420c01*",
"*41c6470c01488b459049894710488d65c85b5e5f415c415d415e415f5dc30000001910090010*",
"488bc8488bd7488b00488b4040ff5030b901000000ba7b030000*",
"488945d8488b4dd8488bd6488b45d8488b00488b4040ff5030*")) and
not (process.Ext.api.name in ("VirtualProtect", "VirtualAlloc") and
_arraysearch(process.thread.Ext.call_stack, $entry,
$entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!RtlAllocateHeap*", "c:\\windows\\sys?????\\dbgeng.dll!DebugCreateEx*"))) and
$entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*",
"c:\\windows\\sys?????\\ntdll.dll!LdrGetDllHandle*",
"c:\\windows\\system32\\ntdll.dll!LdrResolveDelayLoadedAPI*",
"c:\\windows\\sys?????\\ntdll.dll!RtlAllocateHeap*",
"c:\\windows\\sys?????\\dbgeng.dll!DebugCreateEx*",
"c:\\windows\\system32\\ntdll.dll!LdrGetProcedureAddress*",
"c:\\windows\\system32\\advapi32.dll!ReadEventLogW*"))) and
not (process.Ext.api.parameters.size <= 4096 and process.thread.Ext.call_stack_summary like ("ntdll.dll|umppc*.dll|scriptcontrol*.dll|Unbacked", "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|dbghelp.dll|Unbacked*")) and
not (process.parent.executable : "C:\\Windows\\System32\\gpscript.exe" and process.thread.Ext.call_stack_summary == "ntdll.dll|Unknown|yourphone.ypp.dll") and
not process.thread.Ext.call_stack_summary like ("ntdll.dll|Unknown*", "ntdll.dll|kernelbase.dll|Unknown")
behavior/rules/windows/execution_suspicious_command_shell_execution_via_windows_run.toml
+8 -4
View File
@@ -10,7 +10,7 @@ os_list = ["windows"]
reference = [
"https://www.cloudsek.com/blog/unmasking-the-danger-lumma-stealer-malware-exploits-fake-captcha-pages",
]
version = "1.0.6"
version = "1.0.7"
query = '''
process where event.action == "start" and
@@ -24,7 +24,9 @@ process where event.action == "start" and
"C:\\Windows\\System32\\user32.dll!DialogBoxIndirectParamW*",
"C:\\Windows\\System32\\shell32.dll!GetFileNameFromBrowse*")))
) and
not (process.name : "cmd.exe" and process.args : ("*.bat*", "*.cmd", "dir", "ipconfig", "C:\\WINDOWS\\system32\\sconfig.cmd ", "Code\\bin\\code.cmd ", "mkdir")) and
not (process.name : "cmd.exe" and
process.args : ("*.bat*", "*.cmd", "dir", "ipconfig", "C:\\WINDOWS\\system32\\sconfig.cmd ", "Code\\bin\\code.cmd ", "mkdir",
"C:\\Users\\*.cmd ")) and
not (process.name : "powershell.exe" and process.args : ("Start-Process powershell -Verb RunAs", "C:\\*.ps1", "-SPLAGroup", "\\\\*\\netlogon\\*.ps1")) and
not (process.name : "msiexec.exe" and process.args : "?:\\*.msi") and
not process.command_line : ("\"C:\\WINDOWS\\system32\\cmd.exe\" /k net use",
@@ -38,10 +40,12 @@ process where event.action == "start" and
"\"C:\\windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -ep bypass",
"\"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" ise",
"\"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -Command Start-Process PowerShell -Verb RunAs",
"C:\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\Users\\*\\AppData\\Roaming\\npm\\*z.cmd\" \"") and
"C:\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\Users\\*\\AppData\\Roaming\\npm\\*z.cmd\" \"",
"\"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -ExecutionPolicy Bypass") and
not (process.name : ("wscript.exe", "cscript.exe") and process.args : ("\\\\*\\MapNetworkDrives.vbs", "?:\\*.js", "?:\\*.vbs")) and
not (process.name : "powershell.exe" and process.args : "-command" and process.args : "vnc") and
not (process.name : ("msiexec.exe", "powershell.exe", "wscript.exe") and process.working_directory : "\\\\*")
not (process.name : ("msiexec.exe", "powershell.exe", "wscript.exe") and process.working_directory : "\\\\*") and
not (process.name : "msiexec.exe" and process.args : "\\\\*\\SYSVOL\\*.msi")
'''
min_endpoint_version = "8.10.0"

Some files were not shown because too many files have changed in this diff Show More