Merge pull request #1681 from frack113/redcanary_t1228_v2

Redcanary t1228 end

rules/windows/builtin/win_susp_athremotefxvgpudisablementcommand.yml

@@ -0,0 +1,63 @@
+action: global
+title: Abusable Invoke-ATHRemoteFXvGPUDisablementCommand
+id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5
+status: experimental
+author: frack113
+date: 2021/07/13
+description: RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).
+references:
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md
+    - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1
+tags:
+    - attack.defense_evasion
+    - attack.t1218
+fields:
+    - ComputerName
+    - User
+    - CommandLine
+    - ParentCommandLine
+falsepositives:
+    - Unknown
+level: medium
+---
+logsource:
+    product: windows
+    category: process_creation
+detection:
+    selection_cmd:
+        CommandLine|contains: 'Invoke-ATHRemoteFXvGPUDisablementCommand '
+    selection_opt:
+        CommandLine|contains:
+            - '-ModuleName '
+            - '-ModulePath '
+            - '-ScriptBlock '
+            - '-RemoteFXvGPUDisablementFilePath'
+    condition: selection_cmd and selection_opt
+---
+logsource:
+    product: windows
+    service: powershell-classic
+detection:
+    selection_cmd:
+        HostApplication|contains: 'Invoke-ATHRemoteFXvGPUDisablementCommand '
+    selection_opt:
+        HostApplication|contains:
+            - '-ModuleName '
+            - '-ModulePath '
+            - '-ScriptBlock '
+            - '-RemoteFXvGPUDisablementFilePath'
+    condition: selection_cmd and selection_opt
+---
+logsource:
+    product: windows
+    service: powershell
+detection:
+    selection_cmd:
+        ContextInfo|contains: 'Invoke-ATHRemoteFXvGPUDisablementCommand '
+    selection_opt:
+        ContextInfo|contains:
+            - '-ModuleName '
+            - '-ModulePath '
+            - '-ScriptBlock '
+            - '-RemoteFXvGPUDisablementFilePath'
+    condition: selection_cmd and selection_opt

rules/windows/process_creation/process_creation_protocolhandler_suspicious_file.yml

@@ -0,0 +1,29 @@
+title: ProtocolHandler.exe Downloaded Suspicious File
+id: 104cdb48-a7a8-4ca7-a453-32942c6e5dcb
+status: experimental
+author: frack113
+date: 2021/07/13
+description: Emulates attack via documents through protocol handler in Microsoft Office. On successful execution you should see Microsoft Word launch a blank file.
+references:
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md
+tags:
+    - attack.defense_evasion
+    - attack.t1218
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        Image|endswith: '\protocolhandler.exe'
+        CommandLine|contains|all:
+            - '"ms-word'
+            - '.docx"'
+    condition: selection 
+fields:
+    - ComputerName
+    - User
+    - CommandLine
+    - ParentCommandLine
+falsepositives:
+    - Unknown
+level: medium

rules/windows/process_creation/win_workflow_compiler.yml

@@ -6,17 +6,23 @@ tags:
     - attack.defense_evasion
     - attack.execution
     - attack.t1127
-author: Nik Seetharaman
+    - attack.t1218
+author: Nik Seetharaman, frack113
 date: 2019/01/16
+modified: 2021/07/13
 references:
     - https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md
 logsource:
     category: process_creation
     product: windows
 detection:
     selection:
         Image|endswith: '\Microsoft.Workflow.Compiler.exe'
-    condition: selection
+    selection_t1218:
+        OriginalFileName: 'Microsoft.Workflow.Compiler.exe'
+        CommandLine|contains: '.xml'
+    condition: selection or selection_t1218
 fields:
     - CommandLine
     - ParentCommandLine