From b84752b863ed4c7d97359dff79be1bb5dbbc8f4f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 21 Sep 2023 14:00:46 -0700 Subject: [PATCH] conflicts --- .../endpoint/uac_bypass_with_colorui_com_object.yml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index f67a0f1795..f0eaf1cd60 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -12,8 +12,7 @@ data_source: - Sysmon Event ID 7 search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as - firstTime max(_time) as lastTime by Image ImageLoaded process_name dest user EventCode - Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + firstTime max(_time) as lastTime by Image ImageLoaded process_name dest user_id EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -29,16 +28,11 @@ tags: asset_type: Endpoint confidence: 80 impact: 60 - message: The following module $ImageLoaded$ was loaded by a non-standard application - on endpoint $dest$ by user $user$. + message: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $dest$. mitre_attack_id: - T1218 - T1218.003 observable: - - name: user - type: User - role: - - Victim - name: dest type: Hostname role: