From 2db1f87aff0bf927be2d3eb6bfb83969068e33de Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 13 May 2021 11:38:40 -0700 Subject: [PATCH] manifest errors --- detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index 8843771b28..53d47f3a4a 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -6,16 +6,6 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -<<<<<<< HEAD -description: This search is to detect a potential process using COM Object like CMLUA or CMSTPLUA - to bypassed UAC. This technique used by ransomware to gain administrative privileges to its running process. -search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) - NOT(Image IN("*\\windows\\*", "*\\program files\\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `cmlua_or_cmstplua_uac_bypass_filter`' -======= description: This search is to detect a potential process using COM Object like CMLUA or CMSTPLUA to bypassed UAC. This technique used by ransomware to gain administrative privileges to its running process. @@ -24,7 +14,6 @@ search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`' ->>>>>>> 82f9a5f69d687907e6c5b04ca10fcf2458fdf578 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.