From a4a3e01f2585eb48cd9c0ba82ce90a2d9d1a3143 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=9D=D0=B0=D1=82=D0=B0=D0=BB=D1=8C=D1=8F=20=D0=A8=D0=BE?=
 =?UTF-8?q?=D1=80=D0=BD=D0=B8=D0=BA=D0=BE=D0=B2=D0=B0?=
 <n.shornikova@izsoc.ru>
Date: Wed, 28 Oct 2020 19:13:29 +0300
Subject: [PATCH] Splitting into two rules

---
 ...powershell_CL_Mutexverifiers_LOLScript.yml | 13 +--------
 ...ershell_CL_Mutexverifiers_LOLScript_v2.yml | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+), 12 deletions(-)
 create mode 100644 rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml

diff --git a/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml
index d39ce280f..46cbd45be 100644
--- a/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml
+++ b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml
@@ -19,17 +19,6 @@ detection:
         ScriptBlockText|contains|all:
           - 'CL_Mutexverifiers.ps1'
           - 'runAfterCancelProcess'
-    selection2:
-        EventID: 4104
-        ScriptBlockText|contains:
-          - 'CL_Mutexverifiers.ps1'
-          - 'runAfterCancelProcess'
-    timeframe: 1m
-    condition: 
-        - selection
-      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1; runAfterCancelProcess c:\Evil.exe
-        - selection2 | count(ScriptBlockText) by Computer > 2
-      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1
-      # PS > runAfterCancelProcess c:\Evil.exe
+    condition: selection
 falsepositives: Unknown
 level: high
\ No newline at end of file
diff --git a/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml
new file mode 100644
index 000000000..efb5ecc19
--- /dev/null
+++ b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml
@@ -0,0 +1,27 @@
+title: Execution via CL_Mutexverifiers.ps1
+id: 39776c99-1c7b-4ba0-b5aa-641525eee1a4
+description: Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module
+status: experimental
+author: oscd.community, Natalia Shornikova
+date: 2020/10/14
+references:
+    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/CL_mutexverifiers.yml
+    - https://twitter.com/pabraeken/status/995111125447577600
+tags:
+    - attack.defense_evasion
+    - attack.t1216
+logsource:
+    product: windows
+    service: powershell
+detection:
+    selection:
+    selection2:
+        EventID: 4104
+        ScriptBlockText|contains:
+          - 'CL_Mutexverifiers.ps1'
+          - 'runAfterCancelProcess'
+    condition: selection2 | count(ScriptBlockText) by Computer > 2
+      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1
+      # PS > runAfterCancelProcess c:\Evil.exe
+falsepositives: Unknown
+level: high
\ No newline at end of file