From 65273870d172385a4b07d9149fd77c63f8d2da95 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-64-62>
Date: Wed, 18 Aug 2021 15:46:05 +0000
Subject: [PATCH] Added detection testing service results inUAC Bypass With
 Colorui COM Object

---
 .../uac_bypass_with_colorui_com_object.yml    | 33 +++++++++----------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml
index 1b1cf20dca..a95fe39d90 100644
--- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml
+++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml
@@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a possible uac bypass using the colorui.dll COM Object. 
-  this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll 
-  COM CLSID to bypass UAC. 
-search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) 
-  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+description: This search is to detect a possible uac bypass using the colorui.dll
+  COM Object. this technique was seen in so many malware and ransomware like lockbit
+  where it make use of the colorui.dll COM CLSID to bypass UAC.
+search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe"
+  NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as
+  firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode
+  Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `uac_bypass_with_colorui_com_object_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: not so common. but 3rd part app may load this dll.
 references:
 - https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
@@ -36,17 +36,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Image 
-  - ImageLoaded 
-  - process_name 
-  - Computer 
-  - EventCode 
-  - Signed 
+  - Image
+  - ImageLoaded
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
   - ProcessId
   security_domain: endpoint
   impact: 60
-  confidence: 80 
-  # (impact * confidence)/100
+  confidence: 80
   risk_score: 48
   context:
   - Source:Endpoint
@@ -66,4 +65,4 @@ tags:
     type: Other
     role:
     - Other
-  
\ No newline at end of file
+  automated_detection_testing: passed