From 4561d86d810664b13bba15d4ceea4fb0f5b1f743 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 15:56:33 +0100
Subject: [PATCH 01/11] New/Update LOLBIN Rules

---
 .../proc_creation_win_lolbin_adplus.yml       | 35 +++++++++++++++++++
 .../proc_creation_win_lolbin_mftrace.yml      | 22 ++++++++++++
 .../proc_creation_win_lolbin_squirrel.yml     | 31 ++++++++++++++++
 ...c_creation_win_lolbin_vsiisexelauncher.yml | 26 ++++++++++++++
 .../proc_creation_win_susp_dxcap.yml          | 29 ++++++++-------
 5 files changed, 128 insertions(+), 15 deletions(-)
 create mode 100644 rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml
 create mode 100644 rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
 create mode 100644 rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
 create mode 100644 rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml

diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml b/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml
new file mode 100644
index 000000000..c11f08558
--- /dev/null
+++ b/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml
@@ -0,0 +1,35 @@
+title: Use of Adplus.exe
+id: 2f869d59-7f6a-4931-992c-cce556ff2d53
+status: experimental
+description: The "AdPlus.exe" binary that is part of the Windows SDK can be used as a lolbin to dump process memory and execute arbitrary commands
+author: Nasreddine Bencherchali
+references:
+    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/
+date: 2022/06/09
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_img:
+        - Image|endswith: '\Adplus.exe'
+        - OriginalFileName: 'Adplus.exe'
+    selection_cli:
+        CommandLine|contains:
+            # Dump process memory
+            - ' -hang '
+            - ' -pn '
+            - ' -pmn '
+            - ' -p '
+            - ' -po '
+            # Using a config file
+            - ' -c '
+            # Execute commands inline
+            - ' -sc '
+    condition: all of selection*
+falsepositives:
+  - Legitimate usage of Adplus
+level: medium
+tags:
+    - attack.defense_evasion
+    - attack.execution
+    - attack.t1003.001
diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml b/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
new file mode 100644
index 000000000..2cf9d2c43
--- /dev/null
+++ b/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
@@ -0,0 +1,22 @@
+title: Use of Mftrace.exe
+id: 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e
+status: experimental
+description: The "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) can be used to execute arbitrary binaries
+author: Nasreddine Bencherchali
+references:
+    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/
+date: 2022/06/09
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        - Image|endswith: '\mftrace.exe'
+        - OriginalFileName: 'mftrace.exe'
+    condition: selection
+falsepositives:
+  - Legitimate use for tracing purposes
+level: medium
+tags:
+    - attack.defense_evasion
+    - attack.t1127
diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml b/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
new file mode 100644
index 000000000..d5b48b901
--- /dev/null
+++ b/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
@@ -0,0 +1,31 @@
+title: Use of Squirrel.exe
+id: 45239e6a-b035-4aaf-b339-8ad379fcb67e
+status: experimental
+description: The "Squirrel.exe" binary that is part of multiple softwares (Slack, Teams, Discord...etc) can be used as a LOLBIN
+author: Nasreddine Bencherchali
+related:
+    - id: fa4b21c9-0057-4493-b289-2556416ae4d7
+      type: derived
+references:
+    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/
+date: 2022/06/09
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_img:
+        Image|endswith: '\squirrel.exe'
+    selection_cli:
+        CommandLine|contains:
+            - ' --download '
+            - ' --update '
+            - ' --updateRollback='
+    selection_http:
+        CommandLine|contains: 'http'
+    condition: selection
+falsepositives:
+  - See rule (fa4b21c9-0057-4493-b289-2556416ae4d7) for possible FPs
+level: medium
+tags:
+    - attack.defense_evasion
+    - attack.execution
diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml b/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml
new file mode 100644
index 000000000..d91b19014
--- /dev/null
+++ b/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml
@@ -0,0 +1,26 @@
+title: Use of VSIISExeLauncher.exe
+id: 18749301-f1c5-4efc-a4c3-276ff1f5b6f8
+status: experimental
+description: The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries
+author: Nasreddine Bencherchali
+references:
+    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/VSIISExeLauncher/
+date: 2022/06/09
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_img:
+        - Image|endswith: '\VSIISExeLauncher.exe'
+        - OriginalFileName: 'VSIISExeLauncher.exe'
+    selection_cli:
+        CommandLine|contains:
+            - ' -p '
+            - ' -a '
+    condition: all of selection*
+falsepositives:
+  - Unknown
+level: medium
+tags:
+    - attack.defense_evasion
+    - attack.t1127
diff --git a/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml b/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml
index 31a2e2bef..bdd7bc52a 100644
--- a/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml
+++ b/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml
@@ -2,25 +2,24 @@ title: Application Whitelisting Bypass via Dxcap.exe
 id: 60f16a96-db70-42eb-8f76-16763e333590
 status: test
 description: Detects execution of of Dxcap.exe
-author: Beyu Denis, oscd.community
+author: Beyu Denis, oscd.community, Nasreddine Bencherchali (update)
 references:
-  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Dxcap.yml
-  - https://twitter.com/harr0ey/status/992008180904419328
+    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Dxcap.yml
+    - https://twitter.com/harr0ey/status/992008180904419328
 date: 2019/10/26
-modified: 2021/11/27
+modified: 2022/06/09
 logsource:
-  category: process_creation
-  product: windows
+    category: process_creation
+    product: windows
 detection:
-  selection:
-    Image|endswith: '\dxcap.exe'
-    CommandLine|contains|all:
-      - '-c'
-      - '.exe'
-  condition: selection
+    selection_img:
+        - Image|endswith: '\DXCap.exe'
+        - OriginalFilename: 'DXCap.exe'
+    CommandLine|contains: ' -c ' # The ".exe" is not required to run the binary
+    condition: selection
 falsepositives:
-  - Legitimate execution of dxcap.exe by legitimate user
+    - Legitimate execution of dxcap.exe by legitimate user
 level: medium
 tags:
-  - attack.defense_evasion
-  - attack.t1218
+    - attack.defense_evasion
+    - attack.t1218

From 87e813a649a17605eda3262bffe47e0554607659 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 15:58:22 +0100
Subject: [PATCH 02/11] Update proc_creation_win_lolbin_squirrel.yml

---
 .../process_creation/proc_creation_win_lolbin_squirrel.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml b/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
index d5b48b901..3e9581cad 100644
--- a/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
+++ b/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml
@@ -22,7 +22,7 @@ detection:
             - ' --updateRollback='
     selection_http:
         CommandLine|contains: 'http'
-    condition: selection
+    condition: all of selection*
 falsepositives:
   - See rule (fa4b21c9-0057-4493-b289-2556416ae4d7) for possible FPs
 level: medium

From 0a0e976ccf86620f0f261427a22a3924ed9ef014 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 15:58:52 +0100
Subject: [PATCH 03/11] Update proc_creation_win_susp_dxcap.yml

---
 .../process_creation/proc_creation_win_susp_dxcap.yml        | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml b/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml
index bdd7bc52a..59a102753 100644
--- a/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml
+++ b/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml
@@ -15,8 +15,9 @@ detection:
     selection_img:
         - Image|endswith: '\DXCap.exe'
         - OriginalFilename: 'DXCap.exe'
-    CommandLine|contains: ' -c ' # The ".exe" is not required to run the binary
-    condition: selection
+    selection_cli:
+        CommandLine|contains: ' -c ' # The ".exe" is not required to run the binary
+    condition: all of selection*
 falsepositives:
     - Legitimate execution of dxcap.exe by legitimate user
 level: medium

From f4b0dd69f197913490c19786932b1d7fbe264a7d Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 16:15:28 +0100
Subject: [PATCH 04/11] Update proc_creation_win_lolbin_adplus.yml

---
 .../process_creation/proc_creation_win_lolbin_adplus.yml      | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml b/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml
index c11f08558..cf4747938 100644
--- a/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml
+++ b/rules/windows/process_creation/proc_creation_win_lolbin_adplus.yml
@@ -5,13 +5,15 @@ description: The "AdPlus.exe" binary that is part of the Windows SDK can be used
 author: Nasreddine Bencherchali
 references:
     - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/
+    - https://twitter.com/nas_bench/status/1534916659676422152
+    - https://twitter.com/nas_bench/status/1534915321856917506
 date: 2022/06/09
 logsource:
     category: process_creation
     product: windows
 detection:
     selection_img:
-        - Image|endswith: '\Adplus.exe'
+        - Image|endswith: '\adplus.exe'
         - OriginalFileName: 'Adplus.exe'
     selection_cli:
         CommandLine|contains:

From 78bdfa85a9864245634568eab1bb1d1a8448c448 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 18:00:24 +0100
Subject: [PATCH 05/11] Fix

---
 .../process_creation/proc_creation_win_lolbin_mftrace.yml | 8 ++++++--
 .../process_creation/proc_creation_win_susp_dxcap.yml     | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml b/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
index 2cf9d2c43..1d6dbdb39 100644
--- a/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
+++ b/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
@@ -10,10 +10,14 @@ logsource:
     category: process_creation
     product: windows
 detection:
-    selection:
+    selection_img:
         - Image|endswith: '\mftrace.exe'
         - OriginalFileName: 'mftrace.exe'
-    condition: selection
+    selection_cli:
+        CommandLine|contains: '.exe'
+    parent:
+        ParentImage|endswith: '\mftrace.exe'
+    condition: all of selection* or parent
 falsepositives:
   - Legitimate use for tracing purposes
 level: medium
diff --git a/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml b/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml
index 59a102753..0cbf9fb2f 100644
--- a/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml
+++ b/rules/windows/process_creation/proc_creation_win_susp_dxcap.yml
@@ -4,7 +4,7 @@ status: test
 description: Detects execution of of Dxcap.exe
 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (update)
 references:
-    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Dxcap.yml
+    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/
     - https://twitter.com/harr0ey/status/992008180904419328
 date: 2019/10/26
 modified: 2022/06/09

From a934f587d40c6284c92dcb02952d3e58c4627517 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 18:04:35 +0100
Subject: [PATCH 06/11] Update proc_creation_win_lolbin_mftrace.yml

---
 .../process_creation/proc_creation_win_lolbin_mftrace.yml     | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml b/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
index 1d6dbdb39..0a17e3f7c 100644
--- a/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
+++ b/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
@@ -14,7 +14,9 @@ detection:
         - Image|endswith: '\mftrace.exe'
         - OriginalFileName: 'mftrace.exe'
     selection_cli:
-        CommandLine|contains: '.exe'
+        # This assumes that when someone use mftrace to launch an ".exe" he will add a space and the binary launched will end with ".exe"
+        CommandLine|startswith: '.exe '
+        CommandLine|endswith: '.exe'
     parent:
         ParentImage|endswith: '\mftrace.exe'
     condition: all of selection* or parent

From fc44b0999b0c2d1424b37b35028b9959712af4fe Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 18:47:53 +0100
Subject: [PATCH 07/11] Update proc_creation_win_lolbin_mftrace.yml

---
 .../process_creation/proc_creation_win_lolbin_mftrace.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml b/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
index 0a17e3f7c..acaeb3ada 100644
--- a/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
+++ b/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
@@ -15,7 +15,7 @@ detection:
         - OriginalFileName: 'mftrace.exe'
     selection_cli:
         # This assumes that when someone use mftrace to launch an ".exe" he will add a space and the binary launched will end with ".exe"
-        CommandLine|startswith: '.exe '
+        CommandLine|continas: '.exe '
         CommandLine|endswith: '.exe'
     parent:
         ParentImage|endswith: '\mftrace.exe'

From 639a6dd5504d37d737166de4af48dbc3577fd14b Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 18:52:32 +0100
Subject: [PATCH 08/11] Update proc_creation_win_lolbin_mftrace.yml

---
 .../process_creation/proc_creation_win_lolbin_mftrace.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml b/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
index acaeb3ada..51aee143d 100644
--- a/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
+++ b/rules/windows/process_creation/proc_creation_win_lolbin_mftrace.yml
@@ -15,7 +15,7 @@ detection:
         - OriginalFileName: 'mftrace.exe'
     selection_cli:
         # This assumes that when someone use mftrace to launch an ".exe" he will add a space and the binary launched will end with ".exe"
-        CommandLine|continas: '.exe '
+        CommandLine|contains: '.exe '
         CommandLine|endswith: '.exe'
     parent:
         ParentImage|endswith: '\mftrace.exe'

From 4e1423ba74a524b644143d95d15664abff950dc7 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 19:13:22 +0100
Subject: [PATCH 09/11] Update proc_creation_win_susp_cdb.yml

---
 .../proc_creation_win_susp_cdb.yml            | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/rules/windows/process_creation/proc_creation_win_susp_cdb.yml b/rules/windows/process_creation/proc_creation_win_susp_cdb.yml
index 270070bc0..a592b78e0 100644
--- a/rules/windows/process_creation/proc_creation_win_susp_cdb.yml
+++ b/rules/windows/process_creation/proc_creation_win_susp_cdb.yml
@@ -2,20 +2,25 @@ title: Possible App Whitelisting Bypass via WinDbg/CDB as a Shellcode Runner
 id: b5c7395f-e501-4a08-94d4-57fe7a9da9d2
 status: test
 description: Launch 64-bit shellcode from a debugger script file using cdb.exe.
-author: Beyu Denis, oscd.community
+author: Beyu Denis, oscd.community, Nasreddine Bencherchali
 references:
-  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Cdb.yml
-  - http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
+    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Cdb.yml
+    - http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
+    - https://twitter.com/nas_bench/status/1534957360032120833
 date: 2019/10/26
-modified: 2021/11/27
+modified: 2022/06/09
 logsource:
   category: process_creation
   product: windows
 detection:
-  selection:
-    Image|endswith: '\cdb.exe'
-    CommandLine|contains: '-cf'
-  condition: selection
+    selection_img:
+        - Image|endswith: '\cdb.exe'
+        - OriginalFileName: 'CDB.Exe'
+    selection_cli:
+        CommandLine|contains:
+            - ' -c ' # Using a debugger script
+            - ' -cf '
+  condition: all of selection*
 falsepositives:
   - Legitimate use of debugging tools
 level: medium

From 929d26452960f33a26b06c8677aa683ce14a8bcb Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 19:14:24 +0100
Subject: [PATCH 10/11] Update proc_creation_win_susp_cdb.yml

---
 rules/windows/process_creation/proc_creation_win_susp_cdb.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/proc_creation_win_susp_cdb.yml b/rules/windows/process_creation/proc_creation_win_susp_cdb.yml
index a592b78e0..bd1f21046 100644
--- a/rules/windows/process_creation/proc_creation_win_susp_cdb.yml
+++ b/rules/windows/process_creation/proc_creation_win_susp_cdb.yml
@@ -20,7 +20,7 @@ detection:
         CommandLine|contains:
             - ' -c ' # Using a debugger script
             - ' -cf '
-  condition: all of selection*
+    condition: all of selection*
 falsepositives:
   - Legitimate use of debugging tools
 level: medium

From 7267e547df2f4f466c793325067bcd0f5c7e8484 Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 9 Jun 2022 19:16:38 +0100
Subject: [PATCH 11/11] Update proc_creation_win_susp_cdb.yml

---
 .../process_creation/proc_creation_win_susp_cdb.yml  | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/rules/windows/process_creation/proc_creation_win_susp_cdb.yml b/rules/windows/process_creation/proc_creation_win_susp_cdb.yml
index bd1f21046..f277e2d40 100644
--- a/rules/windows/process_creation/proc_creation_win_susp_cdb.yml
+++ b/rules/windows/process_creation/proc_creation_win_susp_cdb.yml
@@ -22,11 +22,11 @@ detection:
             - ' -cf '
     condition: all of selection*
 falsepositives:
-  - Legitimate use of debugging tools
+    - Legitimate use of debugging tools
 level: medium
 tags:
-  - attack.execution
-  - attack.t1106
-  - attack.defense_evasion
-  - attack.t1218
-  - attack.t1127
+    - attack.execution
+    - attack.t1106
+    - attack.defense_evasion
+    - attack.t1218
+    - attack.t1127