From 6b9466ec208e01fc7e358ebdd64103dd925eee76 Mon Sep 17 00:00:00 2001 From: frack113 Date: Tue, 13 Jul 2021 12:19:07 +0200 Subject: [PATCH 1/4] Add process_creation_protocolhandler_suspicious_file.yml --- ...eation_protocolhandler_suspicious_file.yml | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 rules/windows/process_creation/process_creation_protocolhandler_suspicious_file.yml diff --git a/rules/windows/process_creation/process_creation_protocolhandler_suspicious_file.yml b/rules/windows/process_creation/process_creation_protocolhandler_suspicious_file.yml new file mode 100644 index 000000000..9cd29abb4 --- /dev/null +++ b/rules/windows/process_creation/process_creation_protocolhandler_suspicious_file.yml @@ -0,0 +1,29 @@ +title: ProtocolHandler.exe Downloaded Suspicious File +id: 104cdb48-a7a8-4ca7-a453-32942c6e5dcb +status: experimental +author: frack113 +date: 2021/07/13 +description: Emulates attack via documents through protocol handler in Microsoft Office. On successful execution you should see Microsoft Word launch a blank file. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md +tags: + - attack.defense_evasion + - attack.t1218 +logsource: + category: process_creation + product: windows +detection: + selection: + Image|endswith: '\protocolhandler.exe' + CommandLine|contains|all: + - '"ms-word' + - '.docx"' + condition: selection +fields: + - ComputerName + - User + - CommandLine + - ParentCommandLine +falsepositives: + - Unknown +level: medium From 6d1e8268ba92b85479095f51053e469fa6c96e5c Mon Sep 17 00:00:00 2001 From: frack113 Date: Tue, 13 Jul 2021 13:55:27 +0200 Subject: [PATCH 2/4] update win_workflow_compiler.yml --- .../windows/process_creation/win_workflow_compiler.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/rules/windows/process_creation/win_workflow_compiler.yml b/rules/windows/process_creation/win_workflow_compiler.yml index 9347f2b35..74e39c6d2 100644 --- a/rules/windows/process_creation/win_workflow_compiler.yml +++ b/rules/windows/process_creation/win_workflow_compiler.yml @@ -6,17 +6,23 @@ tags: - attack.defense_evasion - attack.execution - attack.t1127 -author: Nik Seetharaman + - attack.t1218 +author: Nik Seetharaman, frack113 date: 2019/01/16 +modified: 2021/07/13 references: - https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md logsource: category: process_creation product: windows detection: selection: Image|endswith: '\Microsoft.Workflow.Compiler.exe' - condition: selection + selection_t1218: + OriginalFileName: 'Microsoft.Workflow.Compiler.exe' + CommandLine|contains: '.xml' + condition: selection or selection_t1218 fields: - CommandLine - ParentCommandLine From c00dd0bf65f2262192322db67921fde73da2552c Mon Sep 17 00:00:00 2001 From: frack113 Date: Tue, 13 Jul 2021 14:29:00 +0200 Subject: [PATCH 3/4] add win_susp_athremotefxvgpudisablementcommand.yml --- ...susp_athremotefxvgpudisablementcommand.yml | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 rules/windows/builtin/win_susp_athremotefxvgpudisablementcommand.yml diff --git a/rules/windows/builtin/win_susp_athremotefxvgpudisablementcommand.yml b/rules/windows/builtin/win_susp_athremotefxvgpudisablementcommand.yml new file mode 100644 index 000000000..1c9cd2bba --- /dev/null +++ b/rules/windows/builtin/win_susp_athremotefxvgpudisablementcommand.yml @@ -0,0 +1,63 @@ +action: global +title: Abusable Invoke-ATHRemoteFXvGPUDisablementCommand +id: a6fc3c46-23b8-4996-9ea2-573f4c4d88c5 +status: experimental +author: frack113 +date: 2021/07/13 +description: RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339). +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md + - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1 +tags: + - attack.defense_evasion + - attack.t1218 +fields: + - ComputerName + - User + - CommandLine + - ParentCommandLine +falsepositives: + - Unknown +level: medium +--- +logsource: + category: process_creation + product: windows +detection: + selection_cmd: + CommandLine|contains: 'Invoke-ATHRemoteFXvGPUDisablementCommand ' + selection_opt: + CommandLine|contains: + - '-ModuleName ' + - '-ModulePath ' + - '-ScriptBlock ' + - '-RemoteFXvGPUDisablementFilePath' + condition: selection_cmd and selection_opt +--- +logsource: + product: windows + service: powershell-classic +detection: + selection_cmd: + HostApplication|contains: 'Invoke-ATHRemoteFXvGPUDisablementCommand ' + selection_opt: + HostApplication|contains: + - '-ModuleName ' + - '-ModulePath ' + - '-ScriptBlock ' + - '-RemoteFXvGPUDisablementFilePath' + condition: selection_cmd and selection_opt +--- +logsource: + product: windows + service: powershell +detection: + selection_cmd: + ContextInfo|contains: 'Invoke-ATHRemoteFXvGPUDisablementCommand ' + selection_opt: + ContextInfo|contains: + - '-ModuleName ' + - '-ModulePath ' + - '-ScriptBlock ' + - '-RemoteFXvGPUDisablementFilePath' + condition: selection_cmd and selection_opt \ No newline at end of file From 8b14dc6c99484f1efa780a2cef546c5ad612e3ee Mon Sep 17 00:00:00 2001 From: frack113 Date: Tue, 13 Jul 2021 14:42:47 +0200 Subject: [PATCH 4/4] fix [colons] too many spaces after colon --- .../builtin/win_susp_athremotefxvgpudisablementcommand.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/windows/builtin/win_susp_athremotefxvgpudisablementcommand.yml b/rules/windows/builtin/win_susp_athremotefxvgpudisablementcommand.yml index 1c9cd2bba..6ed6682d5 100644 --- a/rules/windows/builtin/win_susp_athremotefxvgpudisablementcommand.yml +++ b/rules/windows/builtin/win_susp_athremotefxvgpudisablementcommand.yml @@ -21,8 +21,8 @@ falsepositives: level: medium --- logsource: - category: process_creation product: windows + category: process_creation detection: selection_cmd: CommandLine|contains: 'Invoke-ATHRemoteFXvGPUDisablementCommand ' @@ -32,7 +32,7 @@ detection: - '-ModulePath ' - '-ScriptBlock ' - '-RemoteFXvGPUDisablementFilePath' - condition: selection_cmd and selection_opt + condition: selection_cmd and selection_opt --- logsource: product: windows