From 3ad0e714fcb810174c30edfab6bf86756845980c Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 13 Apr 2022 19:46:49 -0500 Subject: [PATCH 1/4] push for Jud --- ...connect_to_internet_with_hidden_window.yml | 3 +- ...connect_to_internet_with_hidden_window.yml | 30 +++++++++---------- 2 files changed, 16 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index b1b140370c..c522b16caa 100644 --- a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -23,8 +23,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" - OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(cmd_line, - /(?i)[\\-|\\/|\u2013\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(cmd_line, /(?i)[\\-|\\/|–\|—|―]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 4dfe024d7d..a3851c4529 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -10,21 +10,21 @@ description: The following hunting analytic identifies PowerShell commands utili For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" - OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" - OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(cmd_line, - /(?i)[\\-|\\/|\u2013\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval - start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' +search: "| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,\ + \ \"_time\"), \"string\", null)), cmd_line=lower(ucast(map_get(input_event, \"process\"\ + ), \"string\", null)), process_name=lower(ucast(map_get(input_event, \"process_name\"\ + ), \"string\", null)), process_path=ucast(map_get(input_event, \"process_path\"\ + ), \"string\", null), parent_process_name=ucast(map_get(input_event, \"parent_process_name\"\ + ), \"string\", null), event_id=ucast(map_get(input_event, \"event_id\"), \"string\"\ + , null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name=\"\ + pwsh.exe\" OR process_name=\"pwsh.exe\" OR process_name=\"sqlps.exe\" OR process_name=\"\ + sqltoolsps.exe\" OR process_name=\"powershell.exe\" OR process_name=\"powershell_ise.exe\"\ + \ | where match_regex(cmd_line, /(?i)[\\\\-|\\\\/|\u2013\\|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\\ + \\s+[^-]/)=true | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,\ + \ \"dest_user_id\"), \"string\", null), ucast(map_get(input_event, \"dest_device_id\"\ + ), \"string\", null)), body=create_map([\"event_id\", event_id, \"cmd_line\", cmd_line,\ + \ \"process_name\", process_name, \"parent_process_name\", parent_process_name,\ + \ \"process_path\", process_path]) | into write_ssa_detected_events();" how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. From 81e57c359128dc0b2c48f1ed9a9ad20e7ed3b1b0 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 14 Apr 2022 14:37:01 -0500 Subject: [PATCH 2/4] Modified Regex --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index c522b16caa..7751ca64a7 100644 --- a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" - OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(cmd_line, /(?i)[\\-|\\/|–\|—|―]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true | eval + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]/)=true | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", From b75f8ed6aa7f5cee564897997291d43ffab0ae5a Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 14 Apr 2022 14:40:38 -0500 Subject: [PATCH 3/4] Modifying field name --- ..._powershell_connect_to_internet_with_hidden_window.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 7751ca64a7..c19d80db46 100644 --- a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -16,17 +16,17 @@ description: The following hunting analytic identifies PowerShell commands utili was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + process IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" - OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]/)=true | eval + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where match_regex(process, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]/)=true | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + "string", null)), body=create_map(["event_id", event_id, "process", process, "process_name", process_name, "parent_process_name", parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();' how_to_implement: You must be ingesting data that records process activity from your From 71ad17def8e2c8ef23fa491f21bf5229809e705a Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 14 Apr 2022 14:43:30 -0500 Subject: [PATCH 4/4] Modified 'required fields' --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index c19d80db46..ebe5569c97 100644 --- a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -95,7 +95,7 @@ tags: - process_path - dest_user_id - process - - cmd_line + - process risk_score: 35 risk_severity: low security_domain: endpoint