From 0ebe65532d970355dc9d3686e4c489bb3f2137bc Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 31 Mar 2023 13:12:23 +0200 Subject: [PATCH 1/5] more_3cx --- .../endpoint/non_chrome_process_accessing_chrome_default_dir.yml | 1 + .../endpoint/non_firefox_process_access_firefox_profile_dir.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 989bc63449..631d1fcc12 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -30,6 +30,7 @@ tags: - FIN7 - Remcos - AgentTesla + - 3CX Supply Chain Attack confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 02678b1579..a65d2c16ca 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -31,6 +31,7 @@ tags: - Remcos - Azorult - AgentTesla + - 3CX Supply Chain Attack confidence: 70 context: - Source:Endpoint From 3986869d8dfcc45c41516cc676ecde96ee52acc5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 2 Apr 2023 00:06:41 +0000 Subject: [PATCH 2/5] Bump pytest from 7.2.1 to 7.2.2 Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.2.1 to 7.2.2. - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/pytest/compare/7.2.1...7.2.2) --- updated-dependencies: - dependency-name: pytest dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 7ed9e914ea..577b8970c9 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7,7 +7,7 @@ mock==4.0.3 psutil==5.9.4 pycvesearch==1.2 pydantic==1.10.7 -pytest==7.2.1 +pytest==7.2.2 PyYAML==5.4.1 questionary==1.10.0 requests==2.28.2 From f06323aa870655ab9381005c408424cf07ebbd0e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 3 Apr 2023 11:01:35 -0500 Subject: [PATCH 3/5] Update non_firefox_process_access_firefox_profile_dir.yml text --- .../non_firefox_process_access_firefox_profile_dir.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index a65d2c16ca..32073316fe 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -10,10 +10,10 @@ description: This search is to detect an anomaly event of a non-firefox process the files in the profile folder. This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. Most of the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect - information on the compromised host. This SACL Event (4663) need to be enabled to - tthe firefox profile directory to be eable to use this. Since you monitoring this - access to the folder a noise coming from firefox need to be filter and also sqlite - db browser and explorer .exe to make this detection more stable. + information on the compromised host. This SACL Event (4663) needs to be enabled to + the firefox profile directory to use this. Since this is monitoring the + access to the folder, we have obsevered noise and hence added `ssqlite + db browser` and `explorer.exe` to make this detection more stable. search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type From 4defa7e9b72ff7a991e907d4759906d3b1a49c89 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 3 Apr 2023 11:02:17 -0500 Subject: [PATCH 4/5] Update non_firefox_process_access_firefox_profile_dir.yml --- .../endpoint/non_firefox_process_access_firefox_profile_dir.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 32073316fe..3947e6383b 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -12,7 +12,7 @@ description: This search is to detect an anomaly event of a non-firefox process trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) needs to be enabled to the firefox profile directory to use this. Since this is monitoring the - access to the folder, we have obsevered noise and hence added `ssqlite + access to the folder, we have obsevered noise and hence added `sqlite db browser` and `explorer.exe` to make this detection more stable. search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" From 1487829c9be7d9de325c618c09d0be03fd2f1956 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 3 Apr 2023 11:03:23 -0500 Subject: [PATCH 5/5] Update non_chrome_process_accessing_chrome_default_dir.yml --- .../non_chrome_process_accessing_chrome_default_dir.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 631d1fcc12..bda45066af 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -12,7 +12,7 @@ description: This search is to detect an anomaly event of a non-chrome process a the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect information on the compromised host. This SACL Event (4663) need to be enabled to tthe firefox profile directory to be eable to use this. Since you monitoring - this access to the folder a noise coming from firefox need to be filter and also + this access to the folder, we observed noise that needs to be filter out and hence added sqlite db browser and explorer .exe to make this detection more stable. search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*"