diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py index 9fc187ce80..cc9d0184ba 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py @@ -77,6 +77,7 @@ class ObjToYmlAdapter(Adapter): "id": True, "eventSchema": True, "version": True, + "status": True, "description": True, "search": True, "how_to_implement": True, diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index 89a9d006aa..8c021c3a22 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -1,6 +1,7 @@ name: Anomalous usage of Archive Tools id: 63614a58-10e2-4c6c-ae81-ea1113681439 version: 1 +status: production description: The following detection identifies the usage of archive tools from the command line. search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index a67dfcb554..ba2212367d 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -1,6 +1,7 @@ name: Attempt To Delete Services id: a0c8c292-d01a-11eb-aa18-acde48001122 version: 3 +status: production description: The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 0babd2c2c8..62e46e434c 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -1,6 +1,7 @@ name: Attempt To Disable Services id: afb31de4-d023-11eb-98d5-acde48001122 version: 3 +status: production description: The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 96ce3a156c..8fa7d09ef1 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,6 +1,7 @@ name: Attempted Credential Dump From Registry via Reg exe id: 14038953-e5f2-4daf-acff-5452062baf03 version: 3 +status: production description: The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking. diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 572eba26b4..2c93c6ed91 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -1,6 +1,7 @@ name: BCDEdit Failure Recovery Modification id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13 version: 1 +status: production description: This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index 0769a93a6c..ddff24b1ee 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -1,6 +1,7 @@ name: Clear Unallocated Sector Using Cipher App id: 8f907d90-6173-11ec-9c23-acde48001122 version: 1 +status: production description: this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index 0b3d0bf55f..5c95710a2a 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -1,6 +1,7 @@ name: Delete A Net User id: 8776d79c-d26e-11eb-9a56-acde48001122 version: 4 +status: production description: This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index f90ed068db..7642237a53 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -1,6 +1,7 @@ name: Deny Permission using Cacls Utility id: b76eae28-cd25-11eb-9c92-acde48001122 version: 3 +status: production description: The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the deny permission on a file or directory. Adversaries perform this behavior to prevent responders from reviewing or gaining access to diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 66f8616fc8..0113142ea2 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -1,6 +1,7 @@ name: Detect Prohibited Applications Spawning cmd exe id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 version: 4 +status: production description: The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index c1862cc5bb..bc42a3ba67 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -1,6 +1,7 @@ name: Detect RClone Command-Line Usage id: e8b74268-5454-11ec-a799-acde48001122 version: 1 +status: production description: This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index a96f5a9195..b225bbe959 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -1,6 +1,7 @@ name: Disable Net User Account id: ba858b08-d26c-11eb-af9b-acde48001122 version: 3 +status: production description: This analytic will identify a suspicious command-line that disables a user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used by the adversaries to interrupt availability of accounts and continue the diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index e02d07c982..2a9ac3901a 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -1,6 +1,7 @@ name: DNS Exfiltration Using Nslookup App id: 2452e632-9e0d-11eb-34ba-acde48001122 version: 1 +status: production description: This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index f50eaf9a35..3f9d9c4b86 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -1,6 +1,7 @@ name: Fsutil Zeroing File id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85 version: 1 +status: production description: This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host. diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index fc32e7bda4..5198a10318 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -1,6 +1,7 @@ name: Grant Permission Using Cacls Utility id: c6da561a-cd29-11eb-ae65-acde48001122 version: 3 +status: production description: The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the grant permission on a file or directory. Adversaries perform this behavior to allow components of their files to run, however it allows diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index 44ab76c288..d6497113cb 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -1,6 +1,7 @@ name: Hiding Files And Directories With Attrib exe id: 028e4406-6176-11ec-aec2-acde48001122 version: 1 +status: production description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index abc8311a20..987681feaa 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -1,6 +1,7 @@ name: Modify ACLs Permission Of Files Or Folders id: 9ae9a48a-cdbe-11eb-875a-acde48001122 version: 3 +status: production description: This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone or to a specific user. This technique may be used by the adversary to evade ACLs or protected files access. This changes diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index 2cbbcefe1b..8cff41b051 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -1,6 +1,7 @@ name: Office Product Spawning Windows Script Host id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6 version: 1 +status: production description: The following analytic will identify a Windows Office Product spawning WScript.exe or CScript.exe. Tuning may be required based on legitimate application usage that may spawn scripts from an Office product. diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index 3e2d5a8bb6..33be0c34be 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -1,6 +1,7 @@ name: Resize Shadowstorage Volume id: dbc30554-d27e-11eb-9e5e-acde48001122 version: 3 +status: production description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event and a precursor to deleting diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index aa26c33862..a87a86e741 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -1,6 +1,7 @@ name: Sdelete Application Execution id: fcc52b9a-4616-11ec-8454-acde48001122 version: 1 +status: production description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 5c322f21b6..3a94ec65e6 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -1,6 +1,7 @@ name: System Process Running from Unexpected Location id: 28179107-099a-464a-94d3-08301e6c055f version: 4 +status: production description: An attacker tries might try to use different version of a system command without overriding original, or they might try to avoid some detection running the process from a different folder. This detection checks that a list of system processes diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index 1a22c44bfb..2b8e02d1a0 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -1,6 +1,7 @@ name: WBAdmin Delete System Backups id: 71efbf52-4dbb-4c00-a520-306aa546cbb7 version: 1 +status: production description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery. diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index a74aa387f6..d435af7fac 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -1,6 +1,7 @@ name: WevtUtil Usage To Clear Logs id: 5438113c-cdd9-11eb-93b8-acde48001122 version: 2 +status: production description: The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, powershell, sysmon, or system event logs. diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 423c110ccc..f2b9f9c122 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -1,6 +1,7 @@ name: Wevtutil Usage To Disable Logs id: a4bdc944-cdd9-11eb-ac97-acde48001122 version: 2 +status: production description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections in compromised host. diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index d810c3e4e5..4b17f03e50 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -1,6 +1,7 @@ name: Windows Bits Job Persistence id: 1e25e97a-8ea4-11ec-9767-acde48001122 version: 1 +status: production description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 8ef9fa0746..64c796db92 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -1,6 +1,7 @@ name: Windows Bitsadmin Download File id: d76e8188-8f5a-11ec-ace4-acde48001122 version: 1 +status: production description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index 67fd722158..75394aa5d8 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -1,6 +1,7 @@ name: Windows CertUtil Decode File id: b06983f4-8f72-11ec-ab50-acde48001122 version: 1 +status: production description: CertUtil.exe may be used to `encode` and `decode` a file, including PE and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index fd8dacebe4..243affcbb9 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -1,6 +1,7 @@ name: Windows CertUtil URLCache Download id: 8cb1ad38-8f6d-11ec-87a3-acde48001122 version: 1 +status: production description: Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index 9c70a807aa..bd361b49a6 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -1,6 +1,7 @@ name: Windows CertUtil VerifyCtl Download id: 9ac29c40-8f6b-11ec-b19a-acde48001122 version: 1 +status: production description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index b3669571d7..1299d09929 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -1,6 +1,7 @@ name: Windows COM Hijacking InprocServer32 Modification id: 0ae05a0f-bc84-456b-822a-a5b9c081c7ca version: 1 +status: production description: The following analytic identifies the use of reg.exe performing an add to the InProcServer32, which may be related to COM hijacking. Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index 744e04b56e..8c50496f5e 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -1,6 +1,7 @@ name: Windows Curl Upload to Remote Destination id: cc8d046a-543b-11ec-b864-acde48001122 version: 1 +status: production description: 'The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \ diff --git a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml index a5e83f1ed2..2fd9eaa49e 100644 --- a/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml +++ b/dist/ssa/srs/ssa___windows_default_group_policy_object_modified_with_gpme.yml @@ -1,6 +1,7 @@ name: Windows Default Group Policy Object Modified with GPME id: bcb55c13-067b-4648-98f3-627010f72520 version: 1 +status: production description: The following analytic identifies the potential edition of a default Group Policy Object. A fresh installation of an Active Directory network will typically contain two default group policy objects `Default Domain Controllers Policy` and diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 0c999d0876..549d3af6e7 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows Defender Tools in Non Standard Path id: c205bd2e-cd5b-4224-8510-578a2a1f83d7 version: 1 +status: production description: The following analytic identifies usage of the MPCmdRun utility that can be abused by adversaries by moving it to a new directory. search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index ef37944b3c..1e0c1c4294 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -1,6 +1,7 @@ name: Windows Diskshadow Proxy Execution id: aa502688-9037-11ec-842d-acde48001122 version: 1 +status: production description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a scripting mode intended for complex scripted backup operations. This feature also allows for execution of arbitrary unsigned code. This analytic looks for the diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index 86312ce4bd..1e7c664493 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows DotNet Binary in Non Standard Path id: 21179107-099a-324a-94d3-08301e6c065f version: 1 +status: production description: The following analytic identifies native .net binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The analytic identifies the .net binary by using a list. If one or the other matches diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index 3f20f3aaf5..ec9f8c933c 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -1,6 +1,7 @@ name: Windows Exchange PowerShell Module Usage id: 1118bc65-b0c7-4589-bc2f-ad6802fd0909 version: 1 +status: production description: 'The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index c1f2034cd3..9455283c54 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -1,6 +1,7 @@ name: Windows Execute Arbitrary Commands with MSDT id: f253f9c2-10f0-4cc8-b469-f505ba8c2038 version: 1 +status: production description: The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve diff --git a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml index 7210a61325..aebf4270d9 100644 --- a/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_file_share_discovery_with_powerview.yml @@ -1,6 +1,7 @@ name: Windows File Share Discovery With Powerview id: ec4f671e-c736-4f78-a4c0-8fe809e952e5 version: 1 +status: production description: The following analytic identifies the use of the Invoke-ShareFinder PowerShell commandlet part of PowerView. This module obtains the list of all active domain computers and lists the active shares on each computer. Network file shares in Active diff --git a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml index a0c8df7164..a0f1d1456a 100644 --- a/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_findstr_gpp_discovery.yml @@ -1,6 +1,7 @@ name: Windows Findstr GPP Discovery id: 73ed0f19-080e-4917-b7c6-56e1760a50d4 version: 1 +status: production description: The following analytic identifies the use of the findstr command employed to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index caca8f71f3..2e243acffe 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -1,6 +1,7 @@ name: Windows Ingress Tool Transfer Using Explorer id: 695bfad6-9662-4f9e-a576-bf02a951aa60 version: 1 +status: production description: The following analytic identifies the Windows Explorer process with a URL within the command-line. Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. Many adversaries abuse this process, diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index 4939a389eb..551be3b0fc 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows LOLBin Binary in Non Standard Path id: 25689101-012a-324a-94d3-08301e6c065a version: 4 +status: production description: The following analytic identifies native living off the land binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index 04027d661a..e07cbafb81 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -1,6 +1,7 @@ name: Windows MSHTA Child Process id: f63f7e9c-9526-11ec-9fc7-acde48001122 version: 2 +status: production description: The following analytic identifies child processes spawning from "mshta.exe". The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index 88c567faca..9e15d39f5a 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -1,6 +1,7 @@ name: Windows MSHTA Command-Line URL id: 9b35c538-94ef-11ec-9439-acde48001122 version: 1 +status: production description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index bfe0659b88..d6d3fed7b3 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -1,6 +1,7 @@ name: Windows MSHTA Inline HTA Execution id: 24962154-9524-11ec-9333-acde48001122 version: 1 +status: production description: The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index 060d41f55b..c9330e644b 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -1,6 +1,7 @@ name: Windows Odbcconf Load Response File id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763 version: 1 +status: production description: The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 187454b817..7fa8c2b113 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -1,6 +1,7 @@ name: Windows OS Credential Dumping with Ntdsutil Export NTDS id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e version: 1 +status: production description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index 82ac46545c..033cf3eda4 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -1,6 +1,7 @@ name: Windows OS Credential Dumping with Procdump id: e102e297-dbe6-4a19-b319-5c08f4c19a06 version: 1 +status: production description: 'Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 43e52a4cf6..fe708d246e 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -1,6 +1,7 @@ name: Windows Powershell Connect to Internet With Hidden Window id: 477e068e-8b6d-11ec-b6c1-81af21670352 version: 2 +status: production description: The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 736e0b05da..8dda385dd2 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -1,6 +1,7 @@ name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser id: d57b4d91-fc91-4482-a325-47693cced1eb version: 1 +status: production description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index d7f5a99b1e..f67512566a 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -1,6 +1,7 @@ name: Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView id: dc3f2af7-ca69-47ce-a122-9f9787e19417 version: 1 +status: production description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 4b899f2c9b..0db2062d2f 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -1,6 +1,7 @@ name: Windows Powershell DownloadFile id: 46440222-81d5-44b1-a376-19dcd70d1b08 version: 1 +status: production description: The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index 176bfc055a..576dad4224 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -1,6 +1,7 @@ name: Windows PowerShell Start-BitsTransfer id: 0bafd086-8f61-11ec-996e-acde48001122 version: 1 +status: production description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the diff --git a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml index 71ca37b2d3..7103c01e00 100644 --- a/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml +++ b/dist/ssa/srs/ssa___windows_powersploit_gpp_discovery.yml @@ -1,6 +1,7 @@ name: Windows PowerSploit GPP Discovery id: fdef746e-71fb-41ce-8ab2-b4a5a6b50ca2 version: 1 +status: production description: The following analytic identifies the use of the Get-GPPPassword PowerShell commandlet employed to search for unsecured credentials Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index 21cca3f8fc..80d6671fe0 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -1,6 +1,7 @@ name: Windows Rasautou DLL Execution id: 6f42b8ce-1e15-11ec-ad5a-acde48001122 version: 1 +status: production description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index 16da05f0aa..54f8ce030b 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path id: c842931e-661f-42bc-a4df-0460d93cfb69 version: 1 +status: production description: The following analytic identifies AccCheckConsole.exe which is a native living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 5bce274dce..498de88b35 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path id: ecaaf956-c516-4980-b08e-8c01c19614ca version: 1 +status: production description: The following analytic identifies adplus.exe which is a native living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index ecd69422fa..0139db7906 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path id: 3284e4f4-67f7-49b6-ad5e-a8fcead2eef8 version: 1 +status: production description: The following analytic identifies Advpack.dll which is a native living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 8d5b573a57..df63439249 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path id: e124f71f-11bc-47e4-9931-6046d256005d version: 1 +status: production description: The following analytic identifies AgentExecutor.exe which is a native living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 3f93be3ac8..734eb27e09 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path id: 057c06c7-ef31-4749-b5c9-199152e53a06 version: 1 +status: production description: The following analytic identifies AppInstaller.exe which is a native living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 7b0d5af043..86bc9edd0f 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path id: 93862a89-abe0-4094-909a-08ec390aa5e3 version: 1 +status: production description: The following analytic identifies Appvlp.exe which is a native living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index f42875000d..a9398650e2 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path id: d75cc561-3828-4d0a-92c4-0eb93bfe0929 version: 1 +status: production description: The following analytic identifies Aspnet_Compiler.exe which is a native living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index ebd4dbec13..2adc237c32 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows Rename System Utilities At exe LOLBAS in Non Standard Path id: 6401d583-0052-4dc5-a713-68b510826d2b version: 1 +status: production description: The following analytic identifies At.exe which is a native living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 857dc390ee..7dd712416c 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -1,6 +1,7 @@ name: Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path id: b8da7ea5-8c16-4eff-9787-54ec271159e0 version: 1 +status: production description: The following analytic identifies Atbroker.exe which is a native living off the land binary or script (LOLBAS) within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index 1a2d458cc2..2b71388551 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -1,6 +1,7 @@ name: Windows Rundll32 Comsvcs Memory Dump id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e version: 5 +status: production description: The following analytic identifies memory dumping using comsvcs.dll with the minidump function with `rundll32.exe`. This technique is common with adversaries who would like to dump the memory of lsass.exe. diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index ab4d55d262..0babec76b2 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -1,6 +1,7 @@ name: Windows Rundll32 Inline HTA Execution id: 0caa1dd6-94f5-11ec-9786-acde48001122 version: 1 +status: production description: The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 1024255a57..b6c2cad420 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -1,6 +1,7 @@ name: Windows Script Host Spawn MSBuild id: 92886f1c-9b11-11ec-848a-acde48001122 version: 1 +status: production description: This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 1a299b5c7c..73198d66e9 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -1,6 +1,7 @@ name: Windows System Binary Proxy Execution Compiled HTML File Decompile id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50 version: 1 +status: production description: The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 51024955d7..74de18d616 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -1,6 +1,7 @@ name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line id: 0fec631a-7c9b-4e4c-b28b-93260953e25f version: 1 +status: production description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index f2a788c237..4a97363a89 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -2,6 +2,7 @@ name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech St Handlers id: ba0c2450-caea-4086-ac3a-a71e2659754b version: 1 +status: production description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index 473f111800..69c6755af5 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -1,6 +1,7 @@ name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer id: 8d1d5570-722c-49a3-996c-2e2cceef5163 version: 1 +status: production description: The following analytic identifies the usage of msiexec.exe using the /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer. Upon triage, review parent process and capture any artifacts for further review. diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 0b7212880c..08c8d1d77d 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -1,6 +1,7 @@ name: Windows System Binary Proxy Execution MSIExec Remote Download id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5 version: 1 +status: production description: The following analytic identifies msiexec.exe with http in the command-line. This procedure will utilize msiexec.exe to download a remote file and load it. During triage, review parallel processes and capture any artifacts on disk for review. diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index f51b95cf5a..b0b97606f3 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -1,6 +1,7 @@ name: Windows System Binary Proxy Execution MSIExec Unregister DLL id: df76a8d1-92e1-4ec9-b8f7-695b5838703e version: 1 +status: production description: The following analytic identifies the usage of msiexec.exe using the /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer. Upon triage, review parent process and capture any artifacts for further review. diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index 701db02b7c..eda773ffec 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -1,6 +1,7 @@ name: Windows WMIPrvse Spawn MSBuild id: 76b3b290-9b31-11ec-a934-acde48001122 version: 1 +status: production description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using