From 7f83008e9ee84ce0e2bcb1474dc002b41cdfe8a5 Mon Sep 17 00:00:00 2001
From: Mohamed Ashraf <47338567+X-Junior@users.noreply.github.com>
Date: Sun, 23 Feb 2025 00:57:41 +0200
Subject: [PATCH] Merge PR #5173 from @X-Junior - New rule additions and some
 fixes

new: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
fix: Python Initiated Connection - Add filter for `pip install`
fix: Python Inline Command Execution - Add filter for whl package installations
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
---
 .../image_load/image_load_clfs_load.yml       | 41 +++++++++++++++++++
 .../net_connection_win_python.yml             |  6 ++-
 ...on_win_python_inline_command_execution.yml | 12 ++++--
 3 files changed, 54 insertions(+), 5 deletions(-)
 create mode 100644 rules/windows/image_load/image_load_clfs_load.yml

diff --git a/rules/windows/image_load/image_load_clfs_load.yml b/rules/windows/image_load/image_load_clfs_load.yml
new file mode 100644
index 000000000..9e615a91c
--- /dev/null
+++ b/rules/windows/image_load/image_load_clfs_load.yml
@@ -0,0 +1,41 @@
+title: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
+id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
+status: experimental
+description: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
+references:
+    - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
+    - https://x.com/Threatlabz/status/1879956781360976155
+author: X__Junior
+date: 2025-01-20
+tags:
+    - attack.execution
+    - attack.t1059
+logsource:
+    category: image_load
+    product: windows
+detection:
+    selection_dll:
+        ImageLoaded|endswith: '\clfs.sys'
+    selection_folders_1:
+        Image|contains:
+            - ':\Perflogs\'
+            - ':\Users\Public\'
+            - '\Temporary Internet'
+            - '\Windows\Temp\'
+    selection_folders_2:
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Favorites\'
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Favourites\'
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Contacts\'
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Pictures\'
+    condition: selection_dll and 1 of selection_folders_*
+falsepositives:
+    - Unknown
+level: medium
diff --git a/rules/windows/network_connection/net_connection_win_python.yml b/rules/windows/network_connection/net_connection_win_python.yml
index 6053c2409..ece5bc9bb 100644
--- a/rules/windows/network_connection/net_connection_win_python.yml
+++ b/rules/windows/network_connection/net_connection_win_python.yml
@@ -7,7 +7,7 @@ references:
     - https://pypi.org/project/scapy/
 author: frack113
 date: 2021-12-10
-modified: 2023-09-07
+modified: 2025-01-20
 tags:
     - attack.discovery
     - attack.t1046
@@ -35,6 +35,10 @@ detection:
         # This could be caused when launching an instance of Jupyter Notebook locally for example but can also be caused by other instances of python opening sockets locally etc. So comment this out if you want to monitor for those instances
         DestinationIp: 127.0.0.1
         SourceIp: 127.0.0.1
+    filter_main_pip:
+        CommandLine|contains|all:
+            - 'pip.exe'
+            - 'install'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying.
diff --git a/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml b/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml
index 24463a9ab..9b7116b30 100644
--- a/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml
+++ b/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml
@@ -8,7 +8,7 @@ references:
     - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-01-02
-modified: 2023-02-17
+modified: 2025-01-20
 tags:
     - attack.execution
     - attack.t1059
@@ -24,13 +24,17 @@ detection:
               - 'python2.exe'
     selection_cli:
         CommandLine|contains: ' -c'
-    filter_python: # Based on baseline
+    filter_main_python: # Based on baseline
         ParentImage|startswith: 'C:\Program Files\Python'
         ParentImage|endswith: '\python.exe'
         ParentCommandLine|contains: '-E -s -m ensurepip -U --default-pip'
-    filter_vscode:
+    filter_optional_vscode:
         ParentImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
-    condition: all of selection_* and not 1 of filter_*
+    filter_optional_pip:
+        CommandLine|contains|all:
+            - '<pip-setuptools-caller>'
+            - 'exec(compile('
+    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Python libraries that use a flag starting with "-c". Filter according to your environment
 level: medium