diff --git a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml index f9215be5f8..b63f7b828f 100644 --- a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml +++ b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml @@ -23,6 +23,7 @@ references: [] tags: analytic_story: - Windows File Extension and Association Abuse + - Masquerading - Rename System Utilities asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml new file mode 100644 index 0000000000..5209721813 --- /dev/null +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -0,0 +1,56 @@ +name: Anomalous usage of 7zip +id: 9364ee8e-a39a-11eb-8f1d-acde48001122 +version: 1 +date: '2021-04-22' +author: Michael Haag, Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies a 7z.exe spawned from `Rundll32.exe` + or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`. + It has been observed where an adversary will rename `7z.exe`. Additional coverage + may be required to identify the behavior of renamed instances of `7z.exe`. During + triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture + any files written to disk and analyze as needed. Review parallel processes for additional + behaviors. Typically, archiving files will result in exfiltration. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z* by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `anomalous_usage_of_7zip_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited as this behavior is not normal + for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip. +references: +- https://attack.mitre.org/techniques/T1560/001/ +- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ +- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/ +tags: + analytic_story: + - Cobalt Strike + - NOBELIUM Group + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1560.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 4f8ff42723..9595c3518c 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -24,6 +24,7 @@ references: [] tags: analytic_story: - Windows File Extension and Association Abuse + - Masquerading - Rename System Utilities asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml new file mode 100644 index 0000000000..792beb1e47 --- /dev/null +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -0,0 +1,54 @@ +name: Office Product Spawning BITSAdmin +id: e8c591f4-a6d7-11eb-8cf7-acde48001122 +version: 1 +date: '2021-04-26' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies the latest behavior utilized by different + malware families (including TA551, IcedID). This detection identifies any Windows + Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line + of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line + arguments as `/transfer /Download /priority Foreground`. In addition, Threat Research + has released a detections identifying suspicious use of `bitsadmin.exe`. In this + instance, we narrow our detection down to the Office suite as a parent process. + During triage, review all file modifications. Capture and analyze any artifacts + on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote + destination, capture and block the IPs or domain. Review additional parallel processes + for further activity. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=bitsadmin.exe + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_bitsadmin_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: No false positives known. Filter as needed. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml new file mode 100644 index 0000000000..45e6299454 --- /dev/null +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -0,0 +1,54 @@ +name: Office Product Spawning CertUtil +id: 6925fe72-a6d5-11eb-9e17-acde48001122 +version: 1 +date: '2021-04-26' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies the latest behavior utilized by different + malware families (including TA551, IcedID). This detection identifies any Windows + Office Product spawning `certutil.exe`. In malicious instances, the command-line + of `certutil.exe` will contain a URL to a remote destination. In addition, Threat + Research has released a detections identifying suspicious use of `certutil.exe`. + In this instance, we narrow our detection down to the Office suite as a parent process. + During triage, review all file modifications. Capture and analyze any artifacts + on disk. The Office Product, or `certutil.exe` will have reached out to a remote + destination, capture and block the IPs or domain. Review additional parallel processes + for further activity. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=certutil.exe + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_certutil_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: No false positives known. Filter as needed. +references: +- https://redcanary.com/threat-detection-report/threats/TA551/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml new file mode 100644 index 0000000000..64047ea8ea --- /dev/null +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -0,0 +1,53 @@ +name: Office Product Spawning MSHTA +id: 6078fa20-a6d2-11eb-b662-acde48001122 +version: 1 +date: '2021-04-26' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies the latest behavior utilized by different + malware families (including TA551, IcedID). This detection identifies any Windows + Office Product spawning `mshta.exe`. In malicious instances, the command-line of + `mshta.exe` will contain the `hta` file locally, or a URL to the remote destination. + In addition, Threat Research has released a detections identifying suspicious use + of `mshta.exe`. In this instance, we narrow our detection down to the Office suite + as a parent process. During triage, review all file modifications. Capture and analyze + any artifacts on disk. The Office Product, or `mshta.exe` will have reached out + to a remote destination, capture and block the IPs or domain. Review additional + parallel processes for further activity. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=mshta.exe + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: No false positives known. Filter as needed. +references: +- https://redcanary.com/threat-detection-report/threats/TA551/ +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml new file mode 100644 index 0000000000..88daae0977 --- /dev/null +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -0,0 +1,55 @@ +name: Office Product Spawning Wmic +id: ffc236d6-a6c9-11eb-95f1-acde48001122 +version: 1 +date: '2021-04-26' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following detection identifies the latest behavior utilized by Ursnif + malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. + In malicious instances, the command-line of `wmic.exe` will contain `wmic process + call create`. In addition, Threat Research has released a detection identifying + the use of `wmic process call create` on the command-line of `wmic.exe`. In this + instance, we narrow our detection down to the Office suite as a parent process. + During triage, review all file modifications. Capture and analyze any artifacts + on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination, + capture and block the IPs or domain. Review additional parallel processes for further + activity. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=wmic.exe + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_wmic_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: No false positives known. Filter as needed. +references: +- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/ +- https://attack.mitre.org/techniques/T1047/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md +tags: + analytic_story: + - Spearphishing Attachments + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - process_id + - parent_process_name + - dest + - user + - parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index fe3b1d84aa..82ad21e6d0 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -233,6 +233,7 @@ references: [] tags: analytic_story: - Windows Defense Evasion Tactics + - Masquerading - Rename System Utilities dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log cis20: diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index fa9a5cbbfd..a45c436486 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -29,6 +29,7 @@ tags: analytic_story: - Trusted Developer Utilities Proxy Execution - Cobalt Strike + - Masquerading - Rename System Utilities asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index 88151d4d33..4d2970ff5f 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild - Cobalt Strike + - Masquerading - Rename System Utilities asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index f5f30f1a77..52c454f9fb 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Trusted Developer Utilities Proxy Execution MSBuild - Cobalt Strike + - Masquerading - Rename System Utilities asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml index c1946a3499..9f8ae2a27e 100644 --- a/detections/endpoint/suspicious_rundll32_rename.yml +++ b/detections/endpoint/suspicious_rundll32_rename.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - Suspicious Rundll32 Activity + - Masquerading - Rename System Utilities asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 832c8ad50a..b391fe512b 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -1,29 +1,36 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d -version: 5 +version: 6 date: '2020-12-08' -author: David Dorsey, Splunk +author: David Dorsey, Michael Haag, Splunk type: batch -datamodel: [] -description: This search looks for system processes that normally run out of C:\Windows\System32\ - or C:\Windows\SysWOW64 that are not run from that location. This can indicate a - malicious process that is trying to hide as a legitimate process. +datamodel: + - Endpoint +description: 'This search looks for system processes that typically execute from `C:\Windows\System32\` + or `C:\Windows\SysWOW64`. This may indicate a malicious process that is trying to hide as a legitimate process.\ + + This detection utilizes a lookup that is deduped `system32` and `syswow64` directories from Server 2016 and Windows 10.\ + + During triage, review the parallel processes - what process moved the native Windows binary? identify any artifacts on disk and review. If a remote destination is contacted, what is the reputation?' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" - Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest - Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name - Processes.process_hash| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| + Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file` | `system_processes_run_from_unexpected_locations_filter`' -how_to_implement: To successfully implement this search you need to ingest details - about process execution from your hosts. Specifically, this search requires the - process name and the full path to the process executable. -known_false_positives: None identified -references: [] +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: This detection may require tuning based on third party applications utilizing native Windows binaries in non-standard paths. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml + - https://attack.mitre.org/techniques/T1036/003/ tags: analytic_story: - Suspicious Command-Line Executions - Unusual Processes - Ransomware + - Masquerading - Rename System Utilities asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/lookups/is_windows_system_file.csv b/lookups/is_windows_system_file.csv index 0b855c730b..96617dd524 100644 --- a/lookups/is_windows_system_file.csv +++ b/lookups/is_windows_system_file.csv @@ -1,244 +1,53 @@ filename,systemFile -arp.exe,true -adaptertroubleshooter.exe,true -applicationframehost.exe,true -atbroker.exe,true -authhost.exe,true -autoworkplace.exe,true -axinstui.exe,true -backgroundtransferhost.exe,true -bdehdcfg.exe,true -bdeuisrv.exe,true -bdeunlockwizard.exe,true -bitlockerdeviceencryption.exe,true -bitlockerwizard.exe,true -bitlockerwizardelev.exe,true -bytecodegenerator.exe,true -camerasettingsuihost.exe,true -castsrv.exe,true -certenrollctrl.exe,true -checknetisolation.exe,true -clipup.exe,true -cloudexperiencehostbroker.exe,true -cloudnotifications.exe,true -cloudstoragewizard.exe,true -compmgmtlauncher.exe,true -compattelrunner.exe,true -computerdefaults.exe,true -credentialuibroker.exe,true -dfdwiz.exe,true -dwwin.exe,true -dataexchangehost.exe,true -defrag.exe,true -devicedisplayobjectprovider.exe,true -deviceeject.exe,true -deviceenroller.exe,true -devicepairingwizard.exe,true -deviceproperties.exe,true -disksnapshot.exe,true -dism.exe,true -displayswitch.exe,true -dmnotificationbroker.exe,true -dmomacpmo.exe,true -dpiscaling.exe,true -dsmusertask.exe,true -dxpserver.exe,true -edpcleanup.exe,true -eosnotify.exe,true -eap3host.exe,true -easpoliciesbrokerhost.exe,true -easeofaccessdialog.exe,true -ehstorauthn.exe,true -fxscover.exe,true -fxssvc.exe,true -fxsunatd.exe,true -filehistory.exe,true -fondue.exe,true -gamepanel.exe,true -genvalobj.exe,true -gettingstarted.exe,true -hostname.exe,true -icsentitlementhost.exe,true -infdefaultinstall.exe,true -installagent.exe,true -languagecomponentsinstallercomhandler.exe,true -launchtm.exe,true -launchwinapp.exe,true -legacynetuxhost.exe,true -licensemanagershellext.exe,true -licensingui.exe,true -locationnotificationwindows.exe,true -locationnotifications.exe,true -locator.exe,true -lockapphost.exe,true -lockscreencontentserver.exe,true -logonui.exe,true -lsaiso.exe,true -mdeserver.exe,true -mdmagent.exe,true -mdmappinstaller.exe,true -mrinfo.exe,true -mrt.exe,true -mschedexe.exe,true -magnify.exe,true -mbaeparsertask.exe,true -mdres.exe,true -mdsched.exe,true -migautoplay.exe,true -mpsigstub.exe,true -msspellcheckinghost.exe,true -muiunattend.exe,true -multidigimon.exe,true -musnotification.exe,true -musnotificationux.exe,true -napstat.exe,true -netstat.exe,true -narrator.exe,true -netcfgnotifyobjecthost.exe,true -netevtfwdr.exe,true -netproj.exe,true -netplwiz.exe,true -networkuxbroker.exe,true -openwith.exe,true -optionalfeatures.exe,true -pathping.exe,true -ping.exe,true -passwordonwakesettingflyout.exe,true -pickerhost.exe,true -pkgmgr.exe,true -pnpunattend.exe,true -pnputil.exe,true -presentationhost.exe,true -presentationsettings.exe,true -printbrmui.exe,true -printdialoghost.exe,true -printdialoghost3d.exe,true -printisolationhost.exe,true -proximityuxhost.exe,true -rdspnf.exe,true -rmactivate.exe,true -rmactivate_isv.exe,true -rmactivate_ssp.exe,true -rmactivate_ssp_isv.exe,true -route.exe,true -rdpsa.exe,true -rdpsaproxy.exe,true -rdpsauachelper.exe,true -reagentc.exe,true -recoverydrive.exe,true -register-cimprovider.exe,true -registeriepkeys.exe,true -relpost.exe,true -remoteposworker.exe,true -rmclient.exe,true -robocopy.exe,true -rpcping.exe,true -runlegacycplelevated.exe,true -runtimebroker.exe,true -sihclient.exe,true -searchfilterhost.exe,true -searchindexer.exe,true -searchprotocolhost.exe,true -secedit.exe,true -sensordataservice.exe,true -setieinstalleddate.exe,true -settingsynchost.exe,true -slidetoshutdown.exe,true -smartscreensettings.exe,true -sndvol.exe,true -snippingtool.exe,true -soundrecorder.exe,true -spaceagent.exe,true -sppextcomobj.exe,true -srtasks.exe,true -stikynot.exe,true -synchost.exe,true -sysreseterr.exe,true -systempropertiesadvanced.exe,true -systempropertiescomputername.exe,true -systempropertiesdataexecutionprevention.exe,true -systempropertieshardware.exe,true -systempropertiesperformance.exe,true -systempropertiesprotection.exe,true -systempropertiesremote.exe,true -systemsettingsadminflows.exe,true -systemsettingsbroker.exe,true -systemsettingsremovedevice.exe,true -tcpsvcs.exe,true -tracert.exe,true -tstheme.exe,true -tswbprxy.exe,true -tapiunattend.exe,true -taskmgr.exe,true -thumbnailextractionhost.exe,true -tokenbrokercookies.exe,true -tpminit.exe,true -tswpfwrp.exe,true -ui0detect.exe,true -upgraderesultsui.exe,true -useraccountbroker.exe,true -useraccountcontrolsettings.exe,true -usoclient.exe,true -utilman.exe,true -vssvc.exe,true -vaultcmd.exe,true -vaultsysui.exe,true -wfs.exe,true -wmpdmc.exe,true -wpdshextautoplay.exe,true -wscollect.exe,true -wsmanhttpconfig.exe,true -wsreset.exe,true -wudfhost.exe,true -wwahost.exe,true -wallpaperhost.exe,true -webcache.exe,true -werfault.exe,true -werfaultsecure.exe,true -winsat.exe,true -windows.media.backgroundplayback.exe,true -windowsactiondialog.exe,true -windowsanytimeupgrade.exe,true -windowsanytimeupgraderesults.exe,true -windowsanytimeupgradeui.exe,true -windowsupdateelevatedinstaller.exe,true -workfolders.exe,true -wpcmon.exe,true acu.exe,true -aitagent.exe,true +AgentService.exe,true aitstatic.exe,true alg.exe,true +AppHostRegistrationVerifier.exe,true appidcertstorecheck.exe,true appidpolicyconverter.exe,true +appidtel.exe,true +ApplicationFrameHost.exe,true +ApplySettingsTemplateCatalog.exe,true +AppVClient.exe,true +AppVDllSurrogate.exe,true +AppVNice.exe,true +AppVStreamingUX.exe,true +ARP.EXE,true at.exe,true +AtBroker.exe,true attrib.exe,true audiodg.exe,true auditpol.exe,true +AuthHost.exe,true autochk.exe,true autoconv.exe,true autofmt.exe,true -baaupdate.exe,true -backgroundtaskhost.exe,true +AxInstUI.exe,true +backgroundTaskHost.exe,true +BackgroundTransferHost.exe,true bcastdvr.exe,true bcdboot.exe,true bcdedit.exe,true -bdechangepin.exe,true -bdeunlock.exe,true +BioIso.exe,true bitsadmin.exe,true bootcfg.exe,true bootim.exe,true -bootsect.exe,true bridgeunattend.exe,true browser_broker.exe,true bthudtask.exe,true +ByteCodeGenerator.exe,true cacls.exe,true calc.exe,true -cdpreference.exe,true +CameraSettingsUIHost.exe,true +CastSrv.exe,true +CertEnrollCtrl.exe,true certreq.exe,true certutil.exe,true change.exe,true changepk.exe,true charmap.exe,true +CheckNetIsolation.exe,true chglogon.exe,true chgport.exe,true chgusr.exe,true @@ -249,6 +58,10 @@ cipher.exe,true cleanmgr.exe,true cliconfg.exe,true clip.exe,true +ClipUp.exe,true +CloudExperienceHostBroker.exe,true +CloudNotifications.exe,true +CloudStorageWizard.exe,true cmd.exe,true cmdkey.exe,true cmdl32.exe,true @@ -258,50 +71,82 @@ cofire.exe,true colorcpl.exe,true comp.exe,true compact.exe,true +CompatTelRunner.exe,true +CompMgmtLauncher.exe,true +ComputerDefaults.exe,true +Configure-SMRemoting.exe,true conhost.exe,true consent.exe,true control.exe,true convert.exe,true +CredentialUIBroker.exe,true credwiz.exe,true cscript.exe,true csrss.exe,true ctfmon.exe,true cttune.exe,true cttunesvr.exe,true -dashost.exe,true +dasHost.exe,true +DataExchangeHost.exe,true +DataSenseLiveTileTask.exe,true dccw.exe,true +dcgpofix.exe,true dcomcnfg.exe,true +dcpromo.exe,true ddodiag.exe,true +Defrag.exe,true +DeviceCensus.exe,true +DeviceEject.exe,true +DeviceEnroller.exe,true +DevicePairingWizard.exe,true +DeviceProperties.exe,true +DFDWiz.exe,true dfrgui.exe,true +dfsrdiag.exe,true dialer.exe,true -diantz.exe,true -dinotify.exe,true +DIMC.exe,true diskpart.exe,true diskperf.exe,true diskraid.exe,true +diskshadow.exe,true +DiskSnapshot.exe,true +Dism.exe,true dispdiag.exe,true +DisplaySwitch.exe,true djoin.exe,true dllhost.exe,true dllhst3g.exe,true dmcertinst.exe,true dmcfghost.exe,true -dmclient.exe,true +DmNotificationBroker.exe,true +DmOmaCpMo.exe,true dnscacheugc.exe,true doskey.exe,true dpapimig.exe,true +DpiScaling.exe,true dpnsvr.exe,true driverquery.exe,true drvcfg.exe,true drvinst.exe,true +DsmUserTask.exe,true dsregcmd.exe,true dstokenclean.exe,true dvdplay.exe,true -dvdupgrd.exe,true dwm.exe,true +DWWIN.EXE,true dxdiag.exe,true +Dxpserver.exe,true +Eap3Host.exe,true +EaseOfAccessDialog.exe,true easinvoker.exe,true +EasPoliciesBrokerHost.exe,true +EDPCleanup.exe,true +edpnotify.exe,true efsui.exe,true +EhStorAuthn.exe,true embeddedapplauncher.exe,true +EmbeddedAppLauncherConfig.exe,true +escUnattend.exe,true esentutl.exe,true eudcedit.exe,true eventcreate.exe,true @@ -309,13 +154,13 @@ eventvwr.exe,true expand.exe,true extrac32.exe,true fc.exe,true -fhmanagew.exe,true find.exe,true findstr.exe,true finger.exe,true fixmapi.exe,true -fltmc.exe,true +fltMC.exe,true fodhelper.exe,true +Fondue.exe,true fontdrvhost.exe,true fontview.exe,true forfiles.exe,true @@ -323,8 +168,9 @@ fsavailux.exe,true fsquirt.exe,true fsutil.exe,true ftp.exe,true -fvenotify.exe,true -fveprompt.exe,true +GameBarPresenceWriter.exe,true +GamePanel.exe,true +GenValObj.exe,true getmac.exe,true gpresult.exe,true gpscript.exe,true @@ -332,45 +178,78 @@ gpupdate.exe,true grpconv.exe,true hdwwiz.exe,true help.exe,true +HOSTNAME.EXE,true +hvax64.exe,true +hvix64.exe,true +hvloader.exe,true hwrcomp.exe,true hwrreg.exe,true +iashost.exe,true icacls.exe,true -icardagt.exe,true +IcsEntitlementHost.exe,true icsunattend.exe,true ie4uinit.exe,true -ieunatt.exe,true -ieetwcollector.exe,true +ieUnatt.exe,true iexpress.exe,true immersivetpmvscmgrsvr.exe,true +InfDefaultInstall.exe,true +InstallAgent.exe,true +InstallAgentUserBroker.exe,true ipconfig.exe,true -irftp.exe,true iscsicli.exe,true iscsicpl.exe,true isoburn.exe,true klist.exe,true ksetup.exe,true ktmutil.exe,true +ktpass.exe,true label.exe,true +LanguageComponentsInstallerComHandler.exe,true +LaunchTM.exe,true +LaunchWinApp.exe,true +LbfoAdmin.exe,true +LegacyNetUXHost.exe,true +LicenseManagerShellext.exe,true licensingdiag.exe,true +LicensingUI.exe,true +LocationNotificationWindows.exe,true +Locator.exe,true +LockAppHost.exe,true +LockScreenContentServer.exe,true lodctr.exe,true logagent.exe,true logman.exe,true logoff.exe,true +LogonUI.exe,true lpkinstall.exe,true lpksetup.exe,true lpremove.exe,true +LsaIso.exe,true lsass.exe,true -lsm.exe,true +Magnify.exe,true makecab.exe,true -manage-bde.exe,true +mavinject.exe,true +MbaeParserTask.exe,true mblctr.exe,true mcbuilder.exe,true -mctadmin.exe,true +MDEServer.exe,true +MDMAgent.exe,true +MDMAppInstaller.exe,true +MdmDiagnosticsTool.exe,true +MdRes.exe,true +MdSched.exe,true mfpmp.exe,true +Microsoft.Uev.CscUnpinTool.exe,true +Microsoft.Uev.SyncController.exe,true mmc.exe,true mobsync.exe,true mountvol.exe,true mpnotify.exe,true +MpSigStub.exe,true +MRINFO.EXE,true +MRT-KB890830.exe,true +MRT.exe,true +MSchedExe.exe,true msconfig.exe,true msdt.exe,true msdtc.exe,true @@ -380,46 +259,70 @@ mshta.exe,true msiexec.exe,true msinfo32.exe,true mspaint.exe,true -msra.exe,true +MsSpellCheckingHost.exe,true mstsc.exe,true mtstocom.exe,true +MuiUnattend.exe,true +MultiDigiMon.exe,true +MusNotification.exe,true +MusNotificationUx.exe,true +Narrator.exe,true nbtstat.exe,true ndadmin.exe,true net.exe,true net1.exe,true netbtugc.exe,true netcfg.exe,true +NetCfgNotifyObjectHost.exe,true +netdom.exe,true +NetEvtFwdr.exe,true +NetHost.exe,true netiougc.exe,true +Netplwiz.exe,true netsh.exe,true +NETSTAT.EXE,true newdev.exe,true nltest.exe,true notepad.exe,true nslookup.exe,true ntoskrnl.exe,true ntprint.exe,true -ocsetup.exe,true odbcad32.exe,true odbcconf.exe,true omadmclient.exe,true omadmprc.exe,true openfiles.exe,true +OpenWith.exe,true +OptionalFeatures.exe,true osk.exe,true -p2phost.exe,true +PackagedCWALauncher.exe,true +PackageInspector.exe,true +PasswordOnWakeSettingFlyout.exe,true +PATHPING.EXE,true pcalua.exe,true pcaui.exe,true -pcawrk.exe,true pcwrun.exe,true perfmon.exe,true phoneactivate.exe,true +PickerHost.exe,true +PING.EXE,true +PkgMgr.exe,true plasrv.exe,true +PnPUnattend.exe,true +pnputil.exe,true poqexec.exe,true powercfg.exe,true +PresentationHost.exe,true +PresentationSettings.exe,true prevhost.exe,true print.exe,true +PrintBrmUi.exe,true +PrintDialogHost.exe,true +PrintDialogHost3D.exe,true printfilterpipelinesvc.exe,true +PrintIsolationHost.exe,true printui.exe,true proquota.exe,true -provtool.exe,true psr.exe,true pwlauncher.exe,true qappsrv.exe,true @@ -427,105 +330,174 @@ qprocess.exe,true query.exe,true quser.exe,true qwinsta.exe,true -rasautou.exe,true rasdial.exe,true -raserver.exe,true -rasphone.exe,true rdpclip.exe,true +rdpinit.exe,true rdpinput.exe,true +RdpSa.exe,true +RdpSaProxy.exe,true +RdpSaUacHelper.exe,true +rdpshell.exe,true +rdpsign.exe,true rdrleakdiag.exe,true -recdisc.exe,true +RDSPnf.exe,true +ReAgentc.exe,true recover.exe,true +RecoveryDrive.exe,true reg.exe,true regedt32.exe,true regini.exe,true +Register-CimProvider.exe,true regsvr32.exe,true rekeywiz.exe,true relog.exe,true -repair-bde.exe,true +RelPost.exe,true +RemotePosWorker.exe,true replace.exe,true reset.exe,true +ResetEngine.exe,true resmon.exe,true +RMActivate.exe,true +RMActivate_isv.exe,true +RMActivate_ssp.exe,true +RMActivate_ssp_isv.exe,true +RmClient.exe,true rmttpmvscmgrsvr.exe,true +Robocopy.exe,true +ROUTE.EXE,true +RpcPing.exe,true rrinstaller.exe,true -rstrui.exe,true +rsopprov.exe,true runas.exe,true rundll32.exe,true +RunLegacyCPLElevated.exe,true runonce.exe,true +RuntimeBroker.exe,true rwinsta.exe,true -sbunattend.exe,true +sacsess.exe,true sc.exe,true schtasks.exe,true +ScriptRunner.exe,true sdbinst.exe,true -sdchange.exe,true -sdclt.exe,true sdiagnhost.exe,true +SearchFilterHost.exe,true +SearchIndexer.exe,true +SearchProtocolHost.exe,true +SecEdit.exe,true secinit.exe,true +securekernel.exe,true +SensorDataService.exe,true +ServerManager.exe,true +ServerManagerLauncher.exe,true services.exe,true sessionmsg.exe,true sethc.exe,true +setres.exe,true setspn.exe,true +SettingSyncHost.exe,true setupcl.exe,true setupugc.exe,true setx.exe,true sfc.exe,true -shadow.exe,true shrpubw.exe,true shutdown.exe,true sigverif.exe,true +SIHClient.exe,true sihost.exe,true +SlideToShutDown.exe,true slui.exe,true +smartscreen.exe,true +SmartScreenSettings.exe,true smss.exe,true +SndVol.exe,true +SnippingTool.exe,true snmptrap.exe,true sort.exe,true -spinstall.exe,true +SpaceAgent.exe,true +spaceman.exe,true spoolsv.exe,true +SppExtComObj.Exe,true sppsvc.exe,true -spreview.exe,true -srdelayed.exe,true +stordiag.exe,true subst.exe,true svchost.exe,true sxstrace.exe,true +SyncAppvPublishingServer.exe,true +SyncHost.exe,true syskey.exe,true +SysResetErr.exe,true systeminfo.exe,true +SystemPropertiesAdvanced.exe,true +SystemPropertiesComputerName.exe,true +SystemPropertiesDataExecutionPrevention.exe,true +SystemPropertiesHardware.exe,true +SystemPropertiesPerformance.exe,true +SystemPropertiesProtection.exe,true +SystemPropertiesRemote.exe,true systemreset.exe,true +SystemSettingsAdminFlows.exe,true +SystemSettingsBroker.exe,true +SystemSettingsRemoveDevice.exe,true systray.exe,true tabcal.exe,true takeown.exe,true -taskeng.exe,true -taskhost.exe,true +TapiUnattend.exe,true taskhostw.exe,true taskkill.exe,true tasklist.exe,true -taskmgr.exe,true +Taskmgr.exe,true tcmsetup.exe,true +TCPSVCS.EXE,true +tdlrecover.exe,true +ThumbnailExtractionHost.exe,true +TieringEngineService.exe,true timeout.exe,true +TokenBrokerCookies.exe,true +TpmInit.exe,true tpmvscmgr.exe,true tpmvscmgrsvr.exe,true tracerpt.exe,true +TRACERT.EXE,true tscon.exe,true tsdiscon.exe,true +tsecimp.exe,true tskill.exe,true +TSTheme.exe,true +TSWbPrxy.exe,true typeperf.exe,true tzsync.exe,true tzutil.exe,true ucsvc.exe,true +UevAgentPolicyGenerator.exe,true +UevAppMonitor.exe,true +UevTemplateBaselineGenerator.exe,true +UevTemplateConfigItemGenerator.exe,true +UI0Detect.exe,true unlodctr.exe,true unregmp2.exe,true +UpgradeResultsUI.exe,true upnpcont.exe,true +UserAccountBroker.exe,true +UserAccountControlSettings.exe,true userinit.exe,true +UsoClient.exe,true +Utilman.exe,true +VaultCmd.exe,true vds.exe,true vdsldr.exe,true verclsid.exe,true verifier.exe,true verifiergui.exe,true -vmicsvc.exe,true vssadmin.exe,true +VSSUIRUN.exe,true +VSSVC.exe,true w32tm.exe,true waitfor.exe,true -wbadmin.exe,true -wbengine.exe,true +WallpaperHost.exe,true +WebCache.exe,true wecutil.exe,true +WerFault.exe,true +WerFaultSecure.exe,true wermgr.exe,true wevtutil.exe,true wextract.exe,true @@ -533,31 +505,249 @@ where.exe,true whoami.exe,true wiaacmgr.exe,true wiawow64.exe,true -wifitask.exe,true wimserv.exe,true +win32calc.exe,true +WinBioDataModelOOBE.exe,true +Windows.Media.BackgroundPlayback.exe,true +WindowsActionDialog.exe,true +WindowsUpdateElevatedInstaller.exe,true wininit.exe,true winload.exe,true winlogon.exe,true winresume.exe,true winrs.exe,true winrshost.exe,true +WinSAT.exe,true winver.exe,true -wisptis.exe,true wkspbroker.exe,true wksprt.exe,true -wlanext.exe,true wlrmdr.exe,true +WMPDMC.exe,true wowreg32.exe,true -wpnpinst.exe,true +WPDShextAutoplay.exe,true wpr.exe,true write.exe,true +WSCollect.exe,true wscript.exe,true +WSManHTTPConfig.exe,true wsmprovhost.exe,true wsqmcons.exe,true +WSReset.exe,true wuapihost.exe,true -wuapp.exe,true wuauclt.exe,true +WUDFHost.exe,true wusa.exe,true +WWAHost.exe,true +XblGameSaveTask.exe,true xcopy.exe,true -xpsrchvw.exe,true xwizard.exe,true +comrepl.exe,true +MigRegDB.exe,true +DiagnosticsHub.StandardCollector.Service.exe,true +DismHost.exe,true +F12Chooser.exe,true +IMJPDCT.EXE,true +IMJPSET.EXE,true +IMJPUEX.EXE,true +imjpuexc.exe,true +IMTCLNWZ.EXE,true +IMTCPROP.exe,true +IMCCPHR.exe,true +ImeBroker.exe,true +imecfmui.exe,true +IMEDICTUPDATEUI.EXE,true +IMEPADSV.EXE,true +IMESEARCH.EXE,true +IMEWDBLD.EXE,true +ChsIME.exe,true +ChtIME.exe,true +mighost.exe,true +audit.exe,true +AuditShD.exe,true +FirstLogonAnim.exe,true +msoobe.exe,true +oobeldr.exe,true +Setup.exe,true +UserOOBEBroker.exe,true +windeploy.exe,true +SpeechUXWiz.exe,true +SpeechModelDownload.exe,true +SpeechRuntime.exe,true +PrintBrm.exe,true +PrintBrmEngine.exe,true +sysprep.exe,true +SystemResetPlatform.exe,true +mofcomp.exe,true +scrcons.exe,true +unsecapp.exe,true +wbemtest.exe,true +WinMgmt.exe,true +WMIADAP.exe,true +WmiApSrv.exe,true +WMIC.exe,true +WmiPrvSE.exe,true +powershell.exe,true +powershell_ise.exe,true +dplaysvr.exe,true +dtdump.exe,true +hh.exe,true +instnm.exe,true +perfhost.exe,true +rasautou.exe,true +rasphone.exe,true +regedit.exe,true +setup16.exe,true +user.exe,true +_isdel.exe,true +agentactivationruntimestarter.exe,true +ApplyTrustOffline.exe,true +ApproveChildRequest.exe,true +appverif.exe,true +baaupdate.exe,true +bash.exe,true +bdechangepin.exe,true +BdeHdCfg.exe,true +BdeUISrv.exe,true +bdeunlock.exe,true +BitLockerDeviceEncryption.exe,true +BitLockerWizard.exe,true +BitLockerWizardElev.exe,true +bootsect.exe,true +browserexport.exe,true +CIDiag.exe,true +CompPkgSrv.exe,true +convertvhd.exe,true +coredpussvr.exe,true +CredentialEnrollmentManager.exe,true +curl.exe,true +CustomInstallExec.exe,true +d3dconfig.exe,true +DataStoreCacheDumpTool.exe,true +DataUsageLiveTileTask.exe,true +deploymentcsphelper.exe,true +desktopimgdownldr.exe,true +DeviceCredentialDeployment.exe,true +directxdatabaseupdater.exe,true +dmclient.exe,true +DTUHandler.exe,true +dusmtask.exe,true +DXCap.exe,true +DXCpl.exe,true +dxgiadaptercache.exe,true +EASPolicyManagerBrokerHost.exe,true +EduPrintProv.exe,true +EoAExperiences.exe,true +fhmanagew.exe,true +FileHistory.exe,true +FsIso.exe,true +fvenotify.exe,true +fveprompt.exe,true +FXSCOVER.exe,true +FXSSVC.exe,true +FXSUNATD.exe,true +hcsdiag.exe,true +hnsdiag.exe,true +hvsievaluator.exe,true +ie4ushowIE.exe,true +IESettingSync.exe,true +InputSwitchToastHandler.exe,true +iotstartup.exe,true +manage-bde.exe,true +MBR2GPT.EXE,true +microsoft.windows.softwarelogo.showdesktop.exe,true +MicrosoftEdgeBCHost.exe,true +MicrosoftEdgeCP.exe,true +MicrosoftEdgeDevTools.exe,true +MicrosoftEdgeSH.exe,true +mmgaserver.exe,true +MoUsoCoreWorker.exe,true +msra.exe,true +MusNotifyIcon.exe,true +NDKPing.exe,true +NgcIso.exe,true +nmbind.exe,true +nmscrub.exe,true +nvspinfo.exe,true +ofdeploy.exe,true +pacjsworker.exe,true +PinEnrollmentBroker.exe,true +PktMon.exe,true +pospaymentsworker.exe,true +provlaunch.exe,true +provtool.exe,true +ProximityUxHost.exe,true +prproc.exe,true +quickassist.exe,true +raserver.exe,true +RDVGHelper.exe,true +recdisc.exe,true +refsutil.exe,true +RemoteAppLifetimeManager.exe,true +RemoteFXvGPUDisablement.exe,true +repair-bde.exe,true +rstrui.exe,true +runexehelper.exe,true +sdchange.exe,true +sdclt.exe,true +SecurityHealthHost.exe,true +SecurityHealthService.exe,true +SecurityHealthSystray.exe,true +SgrmBroker.exe,true +SgrmLpac.exe,true +SpatialAudioLicenseSrv.exe,true +Spectrum.exe,true +srdelayed.exe,true +SrTasks.exe,true +SystemUWPLauncher.exe,true +tar.exe,true +tcblaunch.exe,true +TpmTool.exe,true +ttdinject.exe,true +tttracer.exe,true +UIMgrBroker.exe,true +upfc.exe,true +usocoreworker.exe,true +UtcDecoderHost.exe,true +VBoxControl.exe,true +VBoxService.exe,true +VBoxTray.exe,true +vfpctrl.exe,true +vmcompute.exe,true +vmwp.exe,true +VsGraphicsDesktopEngine.exe,true +VsGraphicsRemoteEngine.exe,true +vsjitdebugger.exe,true +WaaSMedicAgent.exe,true +wbadmin.exe,true +wbengine.exe,true +WFS.exe,true +wifitask.exe,true +Windows.WARP.JITService.exe,true +WinRTNetMUAHostServer.exe,true +wlanext.exe,true +WorkFolders.exe,true +WpcMon.exe,true +WpcTok.exe,true +wpnpinst.exe,true +wscadminui.exe,true +wsl.exe,true +wslconfig.exe,true +WUDFCompanionHost.exe,true +IEChooser.exe,true +wslhost.exe,true +scp.exe,true +sftp.exe,true +ssh-add.exe,true +ssh-agent.exe,true +ssh-keygen.exe,true +ssh-keyscan.exe,true +ssh.exe,true +PerceptionSimulationInput.exe,true +PerceptionSimulationService.exe,true +UNPUXHost.exe,true +UNPUXLauncher.exe,true +UpdateNotificationMgr.exe,true +FaceFodUninstaller.exe,true +wlms.exe,true +OneDriveSetup.exe,true +OposHost.exe,true \ No newline at end of file diff --git a/lookups/is_windows_system_file.yml b/lookups/is_windows_system_file.yml index 413e326626..d41c0a87dc 100644 --- a/lookups/is_windows_system_file.yml +++ b/lookups/is_windows_system_file.yml @@ -1,5 +1,5 @@ default_match: 'false' -description: A list of executable files in Windows\System32 +description: A full baseline of executable files in Windows\System32 and Windows\Syswow64, including sub-directories from Server 2016 and Windows 10. filename: is_windows_system_file.csv min_matches: 1 name: is_windows_system_file diff --git a/stories/masquerading___rename_system_utilities.yml b/stories/masquerading___rename_system_utilities.yml new file mode 100644 index 0000000000..631f9ee4c3 --- /dev/null +++ b/stories/masquerading___rename_system_utilities.yml @@ -0,0 +1,26 @@ +name: 'Masquerading - Rename System Utilities' +id: f0258af4-a6ae-11eb-b3c2-acde48001122 +version: 1 +date: '2021-04-26' +author: Michael Haag, Splunk +type: batch +description: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. +narrative: 'Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. + It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). + An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths.\ + + The following content is here to assist with binaries within `system32` or `syswow64` being moved to a new location or an adversary bringing a the binary in to execute.\ + + There will be false positives as some native Windows processes are moved or ran by third party applications from different paths. If file names are mismatched between the file name on disk and that of the binarys PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.' +references: +- https://attack.mitre.org/techniques/T1036/003/ +tags: + analytic_story: + - Masquerading - Rename System Utilities + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/anomalous_usage_of_7zip.test.yml b/tests/endpoint/anomalous_usage_of_7zip.test.yml new file mode 100644 index 0000000000..369aa469e4 --- /dev/null +++ b/tests/endpoint/anomalous_usage_of_7zip.test.yml @@ -0,0 +1,12 @@ +name: Anomalous usage of 7zip Unit Test +tests: +- name: Anomalous usage of 7zip + file: endpoint/anomalous_usage_of_7zip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/office_product_spawning_bitsadmin.test.yml b/tests/endpoint/office_product_spawning_bitsadmin.test.yml new file mode 100644 index 0000000000..11d3631d3e --- /dev/null +++ b/tests/endpoint/office_product_spawning_bitsadmin.test.yml @@ -0,0 +1,12 @@ +name: Office Product Spawning BITSAdmin Unit Test +tests: +- name: Office Product Spawning BITSAdmin + file: endpoint/office_product_spawning_bitsadmin.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_macros.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/office_product_spawning_certutil.test.yml b/tests/endpoint/office_product_spawning_certutil.test.yml new file mode 100644 index 0000000000..523acf1f7b --- /dev/null +++ b/tests/endpoint/office_product_spawning_certutil.test.yml @@ -0,0 +1,12 @@ +name: Office Product Spawning CertUtil Unit Test +tests: +- name: Office Product Spawning CertUtil + file: endpoint/office_product_spawning_certutil.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_macros.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/office_product_spawning_mshta.test.yml b/tests/endpoint/office_product_spawning_mshta.test.yml new file mode 100644 index 0000000000..5449a0f268 --- /dev/null +++ b/tests/endpoint/office_product_spawning_mshta.test.yml @@ -0,0 +1,12 @@ +name: Office Product Spawning MSHTA Unit Test +tests: +- name: Office Product Spawning MSHTA + file: endpoint/office_product_spawning_mshta.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_macros.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/office_product_spawning_wmic.test.yml b/tests/endpoint/office_product_spawning_wmic.test.yml new file mode 100644 index 0000000000..b020768c41 --- /dev/null +++ b/tests/endpoint/office_product_spawning_wmic.test.yml @@ -0,0 +1,12 @@ +name: Office Product Spawning Wmic Unit Test +tests: +- name: Office Product Spawning Wmic + file: endpoint/office_product_spawning_wmic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_macros.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file