From 903466b1a89ff64b312df691f86a19be0a40e309 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 22 Jun 2023 13:26:40 +0200 Subject: [PATCH] Improved BA detection --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 18f72a8e6a..f580d559a3 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -27,7 +27,7 @@ search: - pwsh.exe selection2: process.cmd_line|re: (?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-] - condition: selection1 and not selection2 + condition: selection1 and selection2 how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 068536e43c..afa33b2910 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -29,7 +29,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND (NOT match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true) + OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval body=create_map( "devices", [ diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 03dd5fb9a6..fcdadc10e5 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -35,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" - OR process_file_name="pwsh.exe") AND (NOT match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true) + OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be