From 95d060e135121289dc825798a2dc38d4d16502c5 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 15 Feb 2022 13:52:01 -0600 Subject: [PATCH 1/2] Character sets are difficult --- bin/generate.py | 2 +- .../malicious_powershell_process___encoded_command.yml | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index bc5d1f9588..6e91a8be2a 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -170,7 +170,7 @@ def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_P output_path = path.join(OUTPUT_PATH, 'default/savedsearches.conf') output = template.render(detections=detections, time=utc_time) with open(output_path, 'w') as f: - output = output.encode('ascii', 'ignore').decode('ascii') + output = output.encode('utf-8', 'ignore').decode('utf-8') f.write(output) return output_path diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 0b1bb8f3ea..59ea163e8c 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -20,12 +20,8 @@ description: 'The following analytic identifies the use of the EncodedCommand Po on admin scripts in use. \ Alternatively, may use regex per matching here https://regexr.com/662ov.' -search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ - \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\ - \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\ - \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ - \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\ - |\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`" +search: + "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`" how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, From 7f8e5221c78ef9ac5825205bbd4fcb1a9e034f11 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 15 Feb 2022 14:17:55 -0600 Subject: [PATCH 2/2] Updated second detection with unicode codepoints --- ...owershell___connect_to_internet_with_hidden_window.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index c6cf21808e..b182cf705a 100644 --- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -15,12 +15,8 @@ description: The following hunting analytic identifies PowerShell commands utili For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. -search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ - \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\ - \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\ - \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ - \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\ - |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`" +search: + "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`" how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints.