Merge branch 'SigmaHQ:master' into nasbench-rule-devel

rules/linux/builtin/lnx_privileged_user_creation.yml

@@ -0,0 +1,34 @@
+title: Privileged User Has Been Created
+id: 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e
+status: experimental
+description: Detects the addition of a new user to a privileged group such as "root" or "sudo"
+references:
+    - https://digital.nhs.uk/cyber-alerts/2018/cc-2825
+    - https://linux.die.net/man/8/useradd
+    - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid
+author: Pawel Mazur
+date: 2022/12/21
+tags:
+    - attack.persistence
+    - attack.t1136.001
+    - attack.t1098
+logsource:
+    product: linux
+    definition: '/var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work'
+detection:
+    # Example of the events that could be observed when matching these would be as follow
+    #   Dec 21 16:42:19 testserver useradd[1337]: new user: name=butter1, UID=1000, GID=0, home=/root, shell=/bin/bash
+    #   Dec 21 17:13:54 testserver useradd[1337]: new user: name=john, UID=0, GID=0, home=/home/john, shell=/bin/bash
+    #   Dec 21 17:24:40 testserver useradd[1337]: new user: name=butter3, UID=1000, GID=10, home=/home/butter3, shell=/bin/bash
+    #   Dec 21 17:30:22 testserver useradd[1337]: new user: name=butter4, UID=1000, GID=27, home=/home/butter4, shell=/bin/bash
+    selection_new_user:
+        - 'new user'
+    selection_uids_gids:
+        - 'GID=0' # root group
+        - 'UID=0' # root UID
+        - 'GID=10' # wheel group
+        - 'GID=27' # sudo group
+    condition: all of selection_*
+falsepositives:
+    - Administrative activity
+level: high

rules/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml

@@ -0,0 +1,25 @@
+title: User Added To Root/Sudoers Group Using Usermod
+id: 6a50f16c-3b7b-42d1-b081-0fdd3ba70a73
+status: experimental
+description: Detects usage of the "usermod" binary to add users add users to the root or suoders groups
+references:
+    - https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/
+    - https://www.configserverfirewall.com/ubuntu-linux/ubuntu-add-user-to-root-group/
+author: TuanLe (GTSC)
+date: 2022/12/21
+tags:
+    - attack.privilege_escalation
+    - attack.persistence
+logsource:
+    product: linux
+    category: process_creation
+detection:
+    selection:
+        Image|endswith: '/usermod'
+        CommandLine|contains:
+            - '-aG root'
+            - '-aG sudoers'
+    condition: selection
+falsepositives:
+    - Legitimate administrator activities
+level: medium

rules/windows/process_creation/proc_creation_win_impersonate_tool.yml

@@ -0,0 +1,38 @@
+title: Impersonate Execution
+id: cf0c254b-22f1-4b2b-8221-e137b3c0af94
+status: experimental
+description: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
+references:
+    - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/
+    - https://github.com/sensepost/impersonate
+author: Sai Prashanth Pulisetti @pulisettis
+date: 2022/12/21
+tags:
+    - attack.privilege_escalation
+    - attack.defense_evasion
+    - attack.t1134.001
+    - attack.t1134.003
+logsource:
+    product: windows
+    category: process_creation
+detection:
+    selection_commandline_exe:
+        CommandLine|contains: 'impersonate.exe'
+    selection_commandline_opt:
+        CommandLine|contains:
+            - ' list '
+            - ' exec '
+            - ' adduser '
+    selection_hash_plain:
+        Hashes|contains:
+            - 'MD5=9520714AB576B0ED01D1513691377D01'
+            - 'SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A'
+            - 'IMPHASH=0A358FFC1697B7A07D0E817AC740DF62'
+    selection_hash_ext:
+        - MD5: '9520714AB576B0ED01D1513691377D01'
+        - SHA256: 'E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A'
+        - IMPHASH: '0A358FFC1697B7A07D0E817AC740DF62'
+    condition: all of selection_commandline_* or 1 of selection_hash_*
+falsepositives:
+    - Unknown
+level: medium