From 0bc37ed468802d1453e9fc8ea1e3aabd32ad59f6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 21 Aug 2023 14:19:56 -0700 Subject: [PATCH 1/2] updating ysmls for risk --- .../endpoint/suspicious_copy_on_system32.yml | 4 ++-- ...ious_dllhost_no_command_line_arguments.yml | 4 ++-- .../suspicious_event_log_service_behavior.yml | 7 +++---- ...ous_gpupdate_no_command_line_arguments.yml | 4 ++-- ...cious_image_creation_in_appdata_folder.yml | 4 ++-- ...icious_kerberos_service_ticket_request.yml | 8 +++---- ...ious_microsoft_workflow_compiler_usage.yml | 2 +- .../endpoint/suspicious_msbuild_path.yml | 2 +- .../endpoint/suspicious_msbuild_spawn.yml | 2 +- ...ious_regsvr32_register_suspicious_path.yml | 2 +- .../suspicious_rundll32_dllregisterserver.yml | 2 +- ...ous_rundll32_no_command_line_arguments.yml | 4 ++-- .../endpoint/suspicious_rundll32_startw.yml | 4 ++-- ...s_scheduled_task_from_public_directory.yml | 4 ++-- ...protocolhost_no_command_line_arguments.yml | 4 ++-- .../suspicious_wav_file_in_appdata_folder.yml | 2 +- .../endpoint/suspicious_wevtutil_usage.yml | 2 +- ...system_information_discovery_detection.yml | 4 ++-- .../time_provider_persistence_registry.yml | 4 ++-- .../uac_bypass_with_colorui_com_object.yml | 4 ++-- ...wn_process_using_the_kerberos_protocol.yml | 10 +++------ ...uthentication_certificates___esc1_auth.yml | 21 ++++++++----------- 22 files changed, 48 insertions(+), 56 deletions(-) diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index e2b5685182..ca05acb70a 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -44,7 +44,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 70 - message: execution of copy exe to copy file from $process$ in $dest$ + message: Execution of copy exe to copy file from $process$ in $dest$ mitre_attack_id: - T1036.003 - T1036 @@ -53,7 +53,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index ec10fa68a3..8e2ddc5f2e 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -15,7 +15,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_dllhost` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -45,7 +45,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index f529914316..e6debc35f6 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -15,8 +15,7 @@ description: The following analytic utilizes Windows Event ID 1100 to identify w data_source: - Sysmon Event ID 1 search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime - max(_time) as lastTime by dest Message EventCode | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `suspicious_event_log_service_behavior_filter` + max(_time) as lastTime by dest Message EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_event_log_service_behavior_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. known_false_positives: It is possible the Event Logging service gets shut down due @@ -34,12 +33,12 @@ tags: asset_type: Endpoint confidence: 30 impact: 30 - message: The Windows Event Log Service shutdown on $ComputerName$ + message: The Windows Event Log Service shutdown on $dest$ mitre_attack_id: - T1070 - T1070.001 observable: - - name: ComputerName + - name: dest type: Endpoint role: - Victim diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index 29a48aa774..4738799e56 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -15,7 +15,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_gpupdate` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -44,7 +44,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index 71ccd0031f..b4bb38d0d7 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -38,11 +38,11 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: process $process_name$ creating image file $file_path$ in $dest$ + message: Process $process_name$ creating image file $file_path$ in $dest$ mitre_attack_id: - T1113 observable: - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml index 601d78cd6d..3417d6487d 100644 --- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml +++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml @@ -17,8 +17,8 @@ description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain data_source: - Windows Security 4769 search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name) - = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 | - table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious + = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 | rename ComputerName as dest| rename Account_Name as user | + table _time, dest, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious | `suspicious_kerberos_service_ticket_request_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting @@ -42,12 +42,12 @@ tags: - CVE-2021-42287 - CVE-2021-42278 impact: 100 - message: A suspicious Kerberos Service Ticket was requested by $Account_Name$ + message: A suspicious Kerberos Service Ticket was requested by $user$ on host $dest$ mitre_attack_id: - T1078 - T1078.002 observable: - - name: ComputerName + - name: dest type: Endpoint role: - Victim diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index 1abdf8ecf7..7c8d8ef0a9 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -41,7 +41,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index b077b803e7..a9e624f9ee 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -52,7 +52,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index 373a1cd15f..cfec80df30 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -46,7 +46,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 77296cf780..360a61303b 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -13,7 +13,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*")) - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`' how_to_implement: You must be ingesting endpoint data that tracks process activity, diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 1d8c98c32f..3cd156d2da 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -16,7 +16,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*dllregisterserver* - by Processes.dest Processes.user Processes.parent_process Processes.original_file_name + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_dllregisterserver_filter`' diff --git a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml index e672e78c55..7bf721cddb 100644 --- a/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml @@ -15,7 +15,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -52,7 +52,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index e1691ee157..6c89d07b94 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -45,7 +45,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 70 - message: rundll32.exe running with suspicious parameters on $dest$ + message: rundll32.exe running with suspicious StartW parameters on $dest$ mitre_attack_id: - T1218 - T1218.011 @@ -54,7 +54,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 9c6c84890d..a9aa2fdc8e 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -35,7 +35,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 70 - message: Suspicious scheduled task registered on $dest$ + message: Suspicious scheduled task registered on $dest$ from Public Directory mitre_attack_id: - T1053.005 - T1053 @@ -44,7 +44,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index d1ed4de967..91ae5c584d 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -16,7 +16,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id - Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name + Processes.process_name Processes.dest Processes.user Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -45,7 +45,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index 11ec1301dd..1e7be049f0 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -42,7 +42,7 @@ tags: mitre_attack_id: - T1113 observable: - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 6fc603e530..a08b894ea9 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -43,7 +43,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Victim diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 3e65a806ac..1f4862157b 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -29,7 +29,7 @@ tags: asset_type: Windows confidence: 50 impact: 30 - message: Potential system information discovery behavior on $dest$ by $User$ + message: Potential system information discovery behavior on $dest$ by $user$ mitre_attack_id: - T1082 observable: @@ -37,7 +37,7 @@ tags: type: Endpoint role: - Victim - - name: User + - name: user type: User role: - Attacker diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 853c30860a..dba8ed1d42 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -14,7 +14,7 @@ data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*") - BY _time span=1h Registry.registry_path Registry.registry_key_name Registry.registry_value_name + BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `time_provider_persistence_registry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting @@ -35,7 +35,7 @@ tags: asset_type: Endpoint confidence: 100 impact: 80 - message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$ + message: modified/added/deleted registry entry $registry_path$ in $dest$ mitre_attack_id: - T1547.003 - T1547 diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 2878d34994..e5392983e3 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -13,7 +13,7 @@ data_source: search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode - Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + Signed ProcessId user | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -39,7 +39,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim diff --git a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml index c2e3517095..29dd976bd9 100644 --- a/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml +++ b/detections/endpoint/unknown_process_using_the_kerberos_protocol.yml @@ -34,16 +34,12 @@ tags: asset_type: Endpoint confidence: 60 impact: 60 - message: '' + message: Unknown process $process_name$ using the kerberos protocol detected on host $dest$ mitre_attack_id: - T1550 observable: - - name: src_ip - type: IP Address - role: - - Attacker - - name: dest_ip - type: IP Address + - name: dest + type: Hostname role: - Victim product: diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml index c0217beff9..9197b58229 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml @@ -5,8 +5,7 @@ date: '2023-05-25' author: Steven Dick status: production type: TTP -description: >- - The following analytic identifies when a suspicious certificate is granted using Active Directory Certificate Services (AD CS) with a Subject Alternative Name (SAN) and then immediately used for authentication. This action alone may not be malicious, however improperly configured certificate templates can be abused to permit privilege escalation and environment compromise due to over permissive settings (AD CS ESC1). +description: The following analytic identifies when a suspicious certificate is granted using Active Directory Certificate Services (AD CS) with a Subject Alternative Name (SAN) and then immediately used for authentication. This action alone may not be malicious, however improperly configured certificate templates can be abused to permit privilege escalation and environment compromise due to over permissive settings (AD CS ESC1). data_source: - Windows Security 4887 - Windows Security 4768 @@ -21,21 +20,19 @@ search: >- | rename Attributes as object_attrs, EventCode as signature_id, name as signature, RequestId as ssl_serial, Requester as ssl_subject_common_name | eval user = lower(coalesce(req_user_1,req_user_2)) | join user - [ - | search `wineventlog_security` EventCode=4768 CertThumbprint=* - | rename TargetUserName as user, Computer as auth_dest, IpAddress as auth_src - | fields auth_src,auth_dest,user - ] + [ + | search `wineventlog_security` EventCode=4768 CertThumbprint=* + | rename TargetUserName as user, Computer as auth_dest, IpAddress as auth_src + | fields auth_src,auth_dest,user + ] | eval src = upper(coalesce(auth_src,req_src)), dest = upper(coalesce(auth_dest,req_dest_1,req_dest_2)), risk_score = 90 | eval flavor_text = case(signature_id=="4887", "User account [".'user'."] authenticated after a suspicious certificate was issued for it by [".'src_user'."] using certificate request ID: ".'ssl_serial') | fields - req_* auth_* | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_steal_authentication_certificates___esc1_authentication_filter` -how_to_implement: >- - To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference. Recommend throttle correlation by RequestId/ssl_serial at minimum. -known_false_positives: >- - False positives may be generated in environments where administrative users or processes are allowed to generate certificates with Subject Alternative Names for authentication. Sources or templates used in these processes may need to be tuned out for accurate function. +how_to_implement: To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference. Recommend throttle correlation by RequestId/ssl_serial at minimum. +known_false_positives: False positives may be generated in environments where administrative users or processes are allowed to generate certificates with Subject Alternative Names for authentication. Sources or templates used in these processes may need to be tuned out for accurate function. references: - https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf - https://github.com/ly4k/Certipy#esc1 @@ -46,7 +43,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 100 - message: Possible AD CS ESC1 authentication - $flavor_text$ + message: Possible AD CS ESC1 authentication on $dest$ mitre_attack_id: - T1649 - T1550 From 81e76b03e7a7202506ff3a10836c399324a8f085 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 21 Aug 2023 17:23:06 -0700 Subject: [PATCH 2/2] fixing up spl --- .../endpoint/uac_bypass_with_colorui_com_object.yml | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index e5392983e3..4dc76a4ded 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -10,10 +10,7 @@ description: This search is to detect a possible uac bypass using the colorui.dl where it make use of the colorui.dll COM CLSID to bypass UAC. data_source: - Sysmon Event ID 7 -search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" - NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as - firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode - Signed ProcessId user | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime by dest parent_process_name process_name ImageLoaded signature_id signature Signed user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -29,16 +26,12 @@ tags: asset_type: Endpoint confidence: 80 impact: 60 - message: The following module $ImageLoaded$ was loaded by a non-standard application - on endpoint $Computer$ by user $user$. + message: The following module $ImageLoaded$ was loaded by a non-standard application $parent_process_name$ + on endpoint $dest$ by user $user_id$. mitre_attack_id: - T1218 - T1218.003 observable: - - name: user - type: User - role: - - Victim - name: dest type: Hostname role: