From ef8f5e626fb1b943fc906c50e49d84ec7a69b10d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=9D=D0=B0=D1=82=D0=B0=D0=BB=D1=8C=D1=8F=20=D0=A8=D0=BE?= =?UTF-8?q?=D1=80=D0=BD=D0=B8=D0=BA=D0=BE=D0=B2=D0=B0?= Date: Thu, 15 Oct 2020 17:55:11 +0300 Subject: [PATCH 1/4] Adding powershell_CL_Mutexverifiers_LOLScript.yml Rule --- ...powershell_CL_Mutexverifiers_LOLScript.yml | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml diff --git a/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml new file mode 100644 index 000000000..d39ce280f --- /dev/null +++ b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml @@ -0,0 +1,35 @@ +title: Execution via CL_Mutexverifiers.ps1 +id: 39776c99-1c7b-4ba0-b5aa-641525eee1a4 +description: Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module +status: experimental +author: oscd.community, Natalia Shornikova +date: 2020/10/14 +references: + - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/CL_mutexverifiers.yml + - https://twitter.com/pabraeken/status/995111125447577600 +tags: + - attack.defense_evasion + - attack.t1216 +logsource: + product: windows + service: powershell +detection: + selection: + EventID: 4104 + ScriptBlockText|contains|all: + - 'CL_Mutexverifiers.ps1' + - 'runAfterCancelProcess' + selection2: + EventID: 4104 + ScriptBlockText|contains: + - 'CL_Mutexverifiers.ps1' + - 'runAfterCancelProcess' + timeframe: 1m + condition: + - selection + # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1; runAfterCancelProcess c:\Evil.exe + - selection2 | count(ScriptBlockText) by Computer > 2 + # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1 + # PS > runAfterCancelProcess c:\Evil.exe +falsepositives: Unknown +level: high \ No newline at end of file From a4a3e01f2585eb48cd9c0ba82ce90a2d9d1a3143 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=9D=D0=B0=D1=82=D0=B0=D0=BB=D1=8C=D1=8F=20=D0=A8=D0=BE?= =?UTF-8?q?=D1=80=D0=BD=D0=B8=D0=BA=D0=BE=D0=B2=D0=B0?= Date: Wed, 28 Oct 2020 19:13:29 +0300 Subject: [PATCH 2/4] Splitting into two rules --- ...powershell_CL_Mutexverifiers_LOLScript.yml | 13 +-------- ...ershell_CL_Mutexverifiers_LOLScript_v2.yml | 27 +++++++++++++++++++ 2 files changed, 28 insertions(+), 12 deletions(-) create mode 100644 rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml diff --git a/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml index d39ce280f..46cbd45be 100644 --- a/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml +++ b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript.yml @@ -19,17 +19,6 @@ detection: ScriptBlockText|contains|all: - 'CL_Mutexverifiers.ps1' - 'runAfterCancelProcess' - selection2: - EventID: 4104 - ScriptBlockText|contains: - - 'CL_Mutexverifiers.ps1' - - 'runAfterCancelProcess' - timeframe: 1m - condition: - - selection - # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1; runAfterCancelProcess c:\Evil.exe - - selection2 | count(ScriptBlockText) by Computer > 2 - # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1 - # PS > runAfterCancelProcess c:\Evil.exe + condition: selection falsepositives: Unknown level: high \ No newline at end of file diff --git a/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml new file mode 100644 index 000000000..efb5ecc19 --- /dev/null +++ b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml @@ -0,0 +1,27 @@ +title: Execution via CL_Mutexverifiers.ps1 +id: 39776c99-1c7b-4ba0-b5aa-641525eee1a4 +description: Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module +status: experimental +author: oscd.community, Natalia Shornikova +date: 2020/10/14 +references: + - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/CL_mutexverifiers.yml + - https://twitter.com/pabraeken/status/995111125447577600 +tags: + - attack.defense_evasion + - attack.t1216 +logsource: + product: windows + service: powershell +detection: + selection: + selection2: + EventID: 4104 + ScriptBlockText|contains: + - 'CL_Mutexverifiers.ps1' + - 'runAfterCancelProcess' + condition: selection2 | count(ScriptBlockText) by Computer > 2 + # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1 + # PS > runAfterCancelProcess c:\Evil.exe +falsepositives: Unknown +level: high \ No newline at end of file From 07f777d1b51185764bcce32c01bf81951887258b Mon Sep 17 00:00:00 2001 From: nsaddler Date: Wed, 28 Oct 2020 19:32:18 +0300 Subject: [PATCH 3/4] Update powershell_CL_Mutexverifiers_LOLScript_v2.yml --- .../powershell_CL_Mutexverifiers_LOLScript_v2.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml index efb5ecc19..f7c4075fa 100644 --- a/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml +++ b/rules/windows/powershell/powershell_CL_Mutexverifiers_LOLScript_v2.yml @@ -1,5 +1,5 @@ -title: Execution via CL_Mutexverifiers.ps1 -id: 39776c99-1c7b-4ba0-b5aa-641525eee1a4 +title: Execution via CL_Mutexverifiers.ps1 (2 Lines) +id: 6609c444-9670-4eab-9636-fe4755a851ce description: Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module status: experimental author: oscd.community, Natalia Shornikova @@ -14,7 +14,6 @@ logsource: product: windows service: powershell detection: - selection: selection2: EventID: 4104 ScriptBlockText|contains: @@ -24,4 +23,4 @@ detection: # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1 # PS > runAfterCancelProcess c:\Evil.exe falsepositives: Unknown -level: high \ No newline at end of file +level: high From 68153b237fc80cedc4c3ac0a1d56ab90ac3c327e Mon Sep 17 00:00:00 2001 From: Thomas Patzke Date: Mon, 2 Nov 2020 22:57:01 +0100 Subject: [PATCH 4/4] Removed ES query tests --- .github/workflows/sigma-test.yml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/.github/workflows/sigma-test.yml b/.github/workflows/sigma-test.yml index ee0c317a5..28931b92e 100644 --- a/.github/workflows/sigma-test.yml +++ b/.github/workflows/sigma-test.yml @@ -23,18 +23,9 @@ jobs: run: | python -m pip install --upgrade pip pip install -r tools/requirements.txt -r tools/requirements-devel.txt - wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - - sudo apt install -y apt-transport-https - echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic.list - sudo apt update - sudo apt install -y elasticsearch - sudo systemctl start elasticsearch - name: Test Sigma Tools and Rules run: | make test - - name: Test Generated Elasticsearch Query Strings - run: | - make test-backend-es-qs - name: Test SQL(ite) Backend run: | make test-backend-sql