Merge pull request #1186 from nsaddler/lolbas107_2

[OSCD] LOLBAS CL_Mutexverifiers - powershell

rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml

@@ -0,0 +1,24 @@
+title: Execution via CL_Mutexverifiers.ps1
+id: 39776c99-1c7b-4ba0-b5aa-641525eee1a4
+description: Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module
+status: experimental
+author: oscd.community, Natalia Shornikova
+date: 2020/10/14
+references:
+    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/CL_mutexverifiers.yml
+    - https://twitter.com/pabraeken/status/995111125447577600
+tags:
+    - attack.defense_evasion
+    - attack.t1216
+logsource:
+    product: windows
+    service: powershell
+detection:
+    selection:
+        EventID: 4104
+        ScriptBlockText|contains|all:
+          - 'CL_Mutexverifiers.ps1'
+          - 'runAfterCancelProcess'
+    condition: selection
+falsepositives: Unknown
+level: high

rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml

@@ -0,0 +1,26 @@
+title: Execution via CL_Mutexverifiers.ps1 (2 Lines)
+id: 6609c444-9670-4eab-9636-fe4755a851ce
+description: Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module
+status: experimental
+author: oscd.community, Natalia Shornikova
+date: 2020/10/14
+references:
+    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/CL_mutexverifiers.yml
+    - https://twitter.com/pabraeken/status/995111125447577600
+tags:
+    - attack.defense_evasion
+    - attack.t1216
+logsource:
+    product: windows
+    service: powershell
+detection:
+    selection2:
+        EventID: 4104
+        ScriptBlockText|contains:
+          - 'CL_Mutexverifiers.ps1'
+          - 'runAfterCancelProcess'
+    condition: selection2 | count(ScriptBlockText) by Computer > 2
+      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1
+      # PS > runAfterCancelProcess c:\Evil.exe
+falsepositives: Unknown
+level: high