security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: avoid Microsoft Defender detections

Browse Source 
We keep the strings as specific as necessary while avoiding Microsoft Defender detections on the rule files
This commit is contained in:
Florian Roth
2022-02-06 08:56:54 +01:00
parent 6ce92b27be
commit e2aa3665af
2 changed files with 21 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/web/web_cve_2021_44228_log4j.yml
+4 -4
View File
@@ -4,7 +4,7 @@ status: experimental
description: Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)
author: Florian Roth
date: 2021/12/10
modified: 2021/12/13
modified: 2022/02/06
references:
- https://www.lunasec.io/docs/blog/log4j-zero-day/
- https://news.ycombinator.com/item?id=29504755
@@ -38,9 +38,9 @@ detection:
- '${${env:BARFOO:-j}'
- '${::-l}${::-d}${::-a}${::-p}'
- '${base64:JHtqbmRp'
- '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
- '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
- '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
- '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
- '${${lower:j}ndi:'
- '${${upper:j}ndi:'
- '${${::-j}${::-n}${::-d}${::-i}:'
condition: keywords
falsepositives:
rules/web/web_cve_2021_44228_log4j_fields.yml
+17 -13
View File
@@ -4,7 +4,7 @@ status: experimental
description: Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)
author: Florian Roth
date: 2021/12/10
modified: 2021/12/16
modified: 2022/02/06
references:
- https://www.lunasec.io/docs/blog/log4j-zero-day/
- https://news.ycombinator.com/item?id=29504755
@@ -35,12 +35,13 @@ detection:
- '${jndi:nds'
- '${jndi:corba'
- '${jndi:iiop'
- 'Reference Class Name: foo'
- '${${env:BARFOO:-j}'
- '${::-l}${::-d}${::-a}${::-p}'
- '${base64:JHtqbmRp'
- '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
- '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
- '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
- '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
- '${${lower:j}ndi:'
- '${${upper:j}ndi:'
- '${${::-j}${::-n}${::-d}${::-i}:'
selection2:
user-agent|contains:
@@ -59,12 +60,13 @@ detection:
- '${jndi:nds'
- '${jndi:corba'
- '${jndi:iiop'
- 'Reference Class Name: foo'
- '${${env:BARFOO:-j}'
- '${::-l}${::-d}${::-a}${::-p}'
- '${base64:JHtqbmRp'
- '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
- '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
- '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
- '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
- '${${lower:j}ndi:'
- '${${upper:j}ndi:'
- '${${::-j}${::-n}${::-d}${::-i}:'
selection3:
cs-uri|contains:
@@ -83,12 +85,13 @@ detection:
- '${jndi:nds'
- '${jndi:corba'
- '${jndi:iiop'
- 'Reference Class Name: foo'
- '${${env:BARFOO:-j}'
- '${::-l}${::-d}${::-a}${::-p}'
- '${base64:JHtqbmRp'
- '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
- '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
- '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
- '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
- '${${lower:j}ndi:'
- '${${upper:j}ndi:'
- '${${::-j}${::-n}${::-d}${::-i}:'
selection4:
cs-referer|contains:
@@ -107,12 +110,13 @@ detection:
- '${jndi:nds'
- '${jndi:corba'
- '${jndi:iiop'
- 'Reference Class Name: foo'
- '${${env:BARFOO:-j}'
- '${::-l}${::-d}${::-a}${::-p}'
- '${base64:JHtqbmRp'
- '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
- '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
- '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
- '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
- '${${lower:j}ndi:'
- '${${upper:j}ndi:'
- '${${::-j}${::-n}${::-d}${::-i}:'
condition: 1 of selection*
falsepositives: