Merge PR #4631 from @nasbench - add rules related to CISA aa23-347a advisory and other updates

new: DLL Names Used By SVR For GraphicalProton Backdoor
new: Enable LM Hash Storage
new: Enable LM Hash Storage - ProcCreation
new: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor
new: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler
update: Compress-Archive Cmdlet Execution - Reudced Level to low and moved to Threat Hunting folder.
update: Disabled Volume Snapshots - Update logic by removing the reg string to also account for potential renamed executions
update: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet - Update logic to be more specific
update: Potential Recon Activity Via Nltest.EXE - Add dnsgetdc coverage and enhance logic by removing /
update: Potential System DLL Sideloading From Non System Locations - Enhance logic by removing hardcoded C: value to account for other potential system locations
update: RestrictedAdminMode Registry Value Tampering - ProcCreation - Update logic the logic to not care about the data. As this registry value has use cases either be it "0" or "1"
update: RestrictedAdminMode Registry Value Tampering - Update logic the logic to not care about the data. As this registry value has use cases either be it "0" or "1"
update: Write Protect For Storage Disabled - Update logic by removing the reg string to also account for potential renamed executions
update: Zip A Folder With PowerShell For Staging In Temp - PowerShell Module - Update logic to be more specific
update: Zip A Folder With PowerShell For Staging In Temp - PowerShell - Update logic to be more specific
update: Zip A Folder With PowerShell For Staging In Temp - PowerShell Script - Update logic to be more specific

---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

rules/windows/powershell/powershell_script/posh_ps_data_compressed.yml

@@ -1,26 +0,0 @@
-title: Data Compressed - PowerShell
-id: 6dc5d284-69ea-42cf-9311-fb1c3932a69a
-status: test
-description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
-references:
-    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560/T1560.md
-author: Timur Zinniatullin, oscd.community
-date: 2019/10/21
-modified: 2022/12/25
-tags:
-    - attack.exfiltration
-    - attack.t1560
-logsource:
-    product: windows
-    category: ps_script
-    definition: 'Requirements: Script Block Logging must be enabled'
-detection:
-    selection:
-        ScriptBlockText|contains|all:
-            - '-Recurse'
-            - '|'
-            - 'Compress-Archive'
-    condition: selection
-falsepositives:
-    - Highly likely if archive operations are done via PowerShell.
-level: low

rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml

@@ -1,12 +1,22 @@
 title: Zip A Folder With PowerShell For Staging In Temp - PowerShell Script
-id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9
+id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 # PowerShell Script
+related:
+    - id: 71ff406e-b633-4989-96ec-bc49d825a412 # PowerShell Classic
+      type: similar
+    - id: daf7eb81-35fd-410d-9d7a-657837e602bb # PowerShell Module
+      type: similar
+    - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 # Process Creation
+      type: similar
 status: test
-description: Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration
+description: |
+    Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
+    An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
-author: frack113
+    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
+author: Nasreddine Bencherchali (Nextron Systems), frack113
 date: 2021/07/20
-modified: 2022/12/02
+modified: 2023/12/18
 tags:
     - attack.collection
     - attack.t1074.001
@@ -15,13 +25,12 @@ logsource:
     category: ps_script
     definition: 'Requirements: Script Block Logging must be enabled'
 detection:
-    selection_4104:
-        ScriptBlockText|contains|all:
-            - 'Compress-Archive '
-            - ' -Path '
-            - ' -DestinationPath '
-            - '$env:TEMP\'
-    condition: selection_4104
+    selection:
+        ScriptBlockText|contains:
+            - 'Compress-Archive -Path*-DestinationPath $env:TEMP'
+            - 'Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\'
+            - 'Compress-Archive -Path*-DestinationPath*:\Windows\Temp\'
+    condition: selection
 falsepositives:
     - Unknown
 level: medium