Nasreddine Bencherchali
2cb7375c6b
update: Cred Dump Tools Dropped Files - Add procdump.exe and procdump64a.exe update: File Download From Browser Process Via Inline URL - Enhance selection by splitting CLI markers for better matching update: Tor Client/Browser Execution - Add additional PE metadata markers update: System Information Discovery via Registry Queries - Enhance registry markers update: PUA - AdFind Suspicious Execution - Add -sc to dclist string for more accurate coverage. fix: Removal Of Index Value to Hide Schedule Task - Registry - Remove EventType condition that broke the rule. fix: Removal Of SD Value to Hide Schedule Task - Registry - Remove EventType condition that broke the rule. fix: Creation of a Local Hidden User Account by Registry - Fix the TargetObject value fix: Potential Persistence Via New AMSI Providers - Registry - Change logsource and fix the rule logic fix: Potential COM Object Hijacking Via TreatAs Subkey - Registry - Change logsource and fix the rule logic fix: Potential Persistence Via Logon Scripts - Registry - Fix incorrect logsource fix: PUA - Sysinternal Tool Execution - Registry - Fix incorrect logsource fix: Suspicious Execution Of Renamed Sysinternals Tools - Registry - Fix incorrect logsource fix: PUA - Sysinternals Tools Execution - Registry - Fix incorrect logsource chore: add CI script for regression chore: add regression data --------- Co-authored-by: swachchhanda000 <87493836+swachchhanda000@users.noreply.github.com> Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
614 lines
18 KiB
YAML
614 lines
18 KiB
YAML
title: THOR
|
|
order: 20
|
|
backends:
|
|
- thor
|
|
# this configuration differs from other configurations and can not be used
|
|
# with the sigmac tool. This configuration is used by the ioc scanners THOR and SPARK.
|
|
logsources:
|
|
# log source configurations for generic sigma rules
|
|
process_creation_1:
|
|
category: process_creation
|
|
product: windows
|
|
conditions:
|
|
EventID: 1
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
process_creation_2:
|
|
category: process_creation
|
|
product: windows
|
|
conditions:
|
|
EventID: 4688
|
|
rewrite:
|
|
product: windows
|
|
service: security
|
|
fieldmappings:
|
|
Image: NewProcessName
|
|
ParentImage: ParentProcessName
|
|
network_connection:
|
|
category: network_connection
|
|
product: windows
|
|
conditions:
|
|
EventID: 3
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
sysmon_status1:
|
|
category: sysmon_status
|
|
product: windows
|
|
conditions:
|
|
EventID: 4
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
sysmon_status2:
|
|
category: sysmon_status
|
|
product: windows
|
|
conditions:
|
|
EventID: 16
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
process_terminated:
|
|
category: process_termination
|
|
product: windows
|
|
conditions:
|
|
EventID: 5
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
driver_loaded:
|
|
category: driver_load
|
|
product: windows
|
|
conditions:
|
|
EventID: 6
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
image_loaded:
|
|
category: image_load
|
|
product: windows
|
|
conditions:
|
|
EventID: 7
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
create_remote_thread:
|
|
category: create_remote_thread
|
|
product: windows
|
|
conditions:
|
|
EventID: 8
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
raw_access_thread:
|
|
category: raw_access_thread
|
|
product: windows
|
|
conditions:
|
|
EventID: 9
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
process_access:
|
|
category: process_access
|
|
product: windows
|
|
conditions:
|
|
EventID: 10
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
file_creation:
|
|
category: file_event
|
|
product: windows
|
|
conditions:
|
|
EventID: 11
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
registry_event1:
|
|
category: registry_event
|
|
product: windows
|
|
conditions:
|
|
EventID: 12
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
registry_event2:
|
|
category: registry_event
|
|
product: windows
|
|
conditions:
|
|
EventID: 13
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
registry_event3:
|
|
category: registry_event
|
|
product: windows
|
|
conditions:
|
|
EventID: 14
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
registry_add:
|
|
category: registry_add
|
|
product: windows
|
|
conditions:
|
|
EventID: 12
|
|
EventType: CreateKey
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
registry_delete_key:
|
|
category: registry_delete
|
|
product: windows
|
|
conditions:
|
|
EventID: 12
|
|
EventType: DeleteKey
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
registry_delete_value:
|
|
category: registry_delete
|
|
product: windows
|
|
conditions:
|
|
EventID: 12
|
|
EventType: DeleteValue
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
registry_set:
|
|
category: registry_set
|
|
product: windows
|
|
conditions:
|
|
EventID: 13
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
registry_rename:
|
|
category: registry_rename
|
|
product: windows
|
|
conditions:
|
|
EventID: 14
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
create_stream_hash:
|
|
category: create_stream_hash
|
|
product: windows
|
|
conditions:
|
|
EventID: 15
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
pipe_created1:
|
|
category: pipe_created
|
|
product: windows
|
|
conditions:
|
|
EventID: 17
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
pipe_created2:
|
|
category: pipe_created
|
|
product: windows
|
|
conditions:
|
|
EventID: 18
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
wmi_event1:
|
|
category: wmi_event
|
|
product: windows
|
|
conditions:
|
|
EventID: 19
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
wmi_event2:
|
|
category: wmi_event
|
|
product: windows
|
|
conditions:
|
|
EventID: 20
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
wmi_event3:
|
|
category: wmi_event
|
|
product: windows
|
|
conditions:
|
|
EventID: 21
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
dns_query:
|
|
category: dns_query
|
|
product: windows
|
|
conditions:
|
|
EventID: 22
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
file_delete:
|
|
category: file_delete
|
|
product: windows
|
|
conditions:
|
|
EventID: 23
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
clipboard_change:
|
|
category: clipboard_change
|
|
product: windows
|
|
conditions:
|
|
EventID: 24
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
process_tampering:
|
|
category: process_tampering
|
|
product: windows
|
|
conditions:
|
|
EventID: 25
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
file_delete_detected:
|
|
category: file_delete_detected
|
|
product: windows
|
|
conditions:
|
|
EventID: 26
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
file_block_executable:
|
|
category: file_block_executable
|
|
product: windows
|
|
conditions:
|
|
EventID: 27
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
file_block_shredding:
|
|
category: file_block_shredding
|
|
product: windows
|
|
conditions:
|
|
EventID: 28
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
file_executable_detected:
|
|
category: file_executable_detected
|
|
product: windows
|
|
conditions:
|
|
EventID: 29
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
sysmon_error:
|
|
category: sysmon_error
|
|
product: windows
|
|
conditions:
|
|
EventID: 255
|
|
rewrite:
|
|
product: windows
|
|
service: sysmon
|
|
# PowerShell Operational
|
|
ps_module:
|
|
category: ps_module
|
|
product: windows
|
|
conditions:
|
|
EventID: 4103
|
|
rewrite:
|
|
product: windows
|
|
service: powershell
|
|
ps_script:
|
|
category: ps_script
|
|
product: windows
|
|
conditions:
|
|
EventID: 4104
|
|
rewrite:
|
|
product: windows
|
|
service: powershell
|
|
# Powershell "classic" channel
|
|
ps_classic_start:
|
|
category: ps_classic_start
|
|
product: windows
|
|
conditions:
|
|
EventID: 400
|
|
rewrite:
|
|
product: windows
|
|
service: powershell-classic
|
|
ps_classic_provider_start:
|
|
category: ps_classic_provider_start
|
|
product: windows
|
|
conditions:
|
|
EventID: 600
|
|
rewrite:
|
|
product: windows
|
|
service: powershell-classic
|
|
ps_classic_script:
|
|
category: ps_classic_script
|
|
product: windows
|
|
conditions:
|
|
EventID: 800
|
|
rewrite:
|
|
product: windows
|
|
service: powershell-classic
|
|
# target system configurations
|
|
windows-application:
|
|
product: windows
|
|
service: application
|
|
sources:
|
|
- "WinEventLog:Application"
|
|
windows-security:
|
|
product: windows
|
|
service: security
|
|
sources:
|
|
- "WinEventLog:Security"
|
|
windows-system:
|
|
product: windows
|
|
service: system
|
|
sources:
|
|
- "WinEventLog:System"
|
|
windows-ntlm:
|
|
product: windows
|
|
service: ntlm
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-NTLM/Operational"
|
|
windows-sysmon:
|
|
product: windows
|
|
service: sysmon
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-Sysmon/Operational"
|
|
windows-powershell:
|
|
product: windows
|
|
service: powershell
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-PowerShell/Operational"
|
|
- "WinEventLog:PowerShellCore/Operational"
|
|
windows-classicpowershell:
|
|
product: windows
|
|
service: powershell-classic
|
|
sources:
|
|
- "WinEventLog:Windows PowerShell"
|
|
windows-taskscheduler:
|
|
product: windows
|
|
service: taskscheduler
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-TaskScheduler/Operational"
|
|
windows-wmi:
|
|
product: windows
|
|
service: wmi
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-WMI-Activity/Operational"
|
|
windows-dhcp:
|
|
product: windows
|
|
service: dhcp
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-DHCP-Server/Operational"
|
|
windows-printservice-admin:
|
|
product: windows
|
|
service: printservice-admin
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-PrintService/Admin"
|
|
windows-smbclient-security:
|
|
product: windows
|
|
service: smbclient-security
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-SmbClient/Security"
|
|
windows-smbclient-connectivity:
|
|
product: windows
|
|
service: smbclient-connectivity
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-SmbClient/Connectivity"
|
|
windows-smbserver-connectivity:
|
|
product: windows
|
|
service: smbserver-connectivity
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-SMBServer/Connectivity"
|
|
windows-printservice-operational:
|
|
product: windows
|
|
service: printservice-operational
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-PrintService/Operational"
|
|
windows-terminalservices-localsessionmanager-operational:
|
|
product: windows
|
|
service: terminalservices-localsessionmanager
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
|
|
windows-codeintegrity-operational:
|
|
product: windows
|
|
service: codeintegrity-operational
|
|
sources:
|
|
- "WinEventLog:Microsoft-Windows-CodeIntegrity/Operational"
|
|
windows-applocker:
|
|
product: windows
|
|
service: applocker
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-AppLocker/MSI and Script'
|
|
- 'WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL'
|
|
- 'WinEventLog:Microsoft-Windows-AppLocker/Packaged app-Deployment'
|
|
- 'WinEventLog:Microsoft-Windows-AppLocker/Packaged app-Execution'
|
|
windows-msexchange-management:
|
|
product: windows
|
|
service: msexchange-management
|
|
sources:
|
|
- 'WinEventLog:MSExchange Management'
|
|
windows-defender:
|
|
product: windows
|
|
service: windefend
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Windows Defender/Operational'
|
|
windows-defender-antivirus-mapping:
|
|
category: antivirus
|
|
conditions:
|
|
EventID: # https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus IDs with existing 'Threat Name' or 'Path'
|
|
- 1006
|
|
- 1007
|
|
- 1008
|
|
- 1009
|
|
- 1010
|
|
- 1011
|
|
- 1012
|
|
- 1017
|
|
- 1018
|
|
- 1019
|
|
- 1115
|
|
- 1116
|
|
rewrite:
|
|
product: windows
|
|
service: windefend
|
|
fieldmappings:
|
|
Signature: ThreatName
|
|
Filename: Path
|
|
windows-firewall-advanced-security:
|
|
product: windows
|
|
service: firewall-as
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall'
|
|
windows-bits-client:
|
|
product: windows
|
|
service: bits-client
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Bits-Client/Operational'
|
|
windows-security-mitigations:
|
|
product: windows
|
|
service: security-mitigations
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Security-Mitigations/Kernel Mode'
|
|
- 'WinEventLog:Microsoft-Windows-Security-Mitigations/User Mode'
|
|
windows-diagnosis:
|
|
product: windows
|
|
service: diagnosis-scripted
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Diagnosis-Scripted/Operational'
|
|
windows-shell-core:
|
|
product: windows
|
|
service: shell-core
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Shell-Core/Operational'
|
|
windows-openssh:
|
|
product: windows
|
|
service: openssh
|
|
sources:
|
|
- 'WinEventLog:OpenSSH/Operational'
|
|
windows-ldap-debug:
|
|
product: windows
|
|
service: ldap
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-LDAP-Client/Debug'
|
|
windows-bitlocker:
|
|
product: windows
|
|
service: bitlocker
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-BitLocker/BitLocker Management'
|
|
windows-vhdmp:
|
|
product: windows
|
|
service: vhdmp
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-VHDMP/Operational'
|
|
windows-appxdeployment-server:
|
|
product: windows
|
|
service: appxdeployment-server
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational'
|
|
windows-lsa-server:
|
|
product: windows
|
|
service: lsa-server
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-LSA/Operational'
|
|
windows-appxpackaging-om:
|
|
product: windows
|
|
service: appxpackaging-om
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-AppxPackaging/Operational'
|
|
windows-dns-client:
|
|
product: windows
|
|
service: dns-client
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-DNS Client Events/Operational'
|
|
windows-appmodel-runtime:
|
|
product: windows
|
|
service: appmodel-runtime
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-AppModel-Runtime/Admin'
|
|
windows-capi2:
|
|
product: windows
|
|
service: capi2
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-CAPI2/Operational'
|
|
windows-certificateservicesclient-lifecycle:
|
|
product: windows
|
|
service: certificateservicesclient-lifecycle-system
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational'
|
|
windows-kernel-shimengine:
|
|
product: windows
|
|
service: kernel-shimengine
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Kernel-ShimEngine/Operational'
|
|
- 'WinEventLog:Microsoft-Windows-Kernel-ShimEngine/Diagnostic'
|
|
windows-application-experience:
|
|
product: windows
|
|
service: application-experience
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Application-Experience/Program-Telemetry'
|
|
- 'WinEventLog:Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant'
|
|
windows-ntfs:
|
|
product: windows
|
|
service: ntfs
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Ntfs/Operational'
|
|
windows-hyper-v-worker:
|
|
product: windows
|
|
service: hyper-v-worker
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Hyper-V-Worker'
|
|
windows-kernel-event-tracing:
|
|
product: windows
|
|
service: kernel-event-tracing
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-Kernel-EventTracing'
|
|
windows-sense:
|
|
product: windows
|
|
service: sense
|
|
sources:
|
|
- 'WinEventLog:Microsoft-Windows-SENSE/Operational'
|
|
windows-servicebus:
|
|
product: windows
|
|
service: servicebus-client
|
|
sources:
|
|
- 'WinEventLog:Microsoft-ServiceBus-Client/Admin'
|
|
- 'WinEventLog:Microsoft-ServiceBus-Client/Operational'
|
|
windows-iis-configuration:
|
|
product: windows
|
|
service: iis-configuration
|
|
sources:
|
|
- 'WinEventLog:Microsoft-IIS-Configuration/Operational'
|
|
apache:
|
|
category: webserver
|
|
sources:
|
|
- "File:/var/log/apache/*.log"
|
|
- "File:/var/log/apache2/*.log"
|
|
- "File:/var/log/httpd/*.log"
|
|
linux-auth:
|
|
product: linux
|
|
service: auth
|
|
sources:
|
|
- "File:/var/log/auth.log"
|
|
- "File:/var/log/auth.log.?"
|
|
linux-syslog:
|
|
product: linux
|
|
service: syslog
|
|
sources:
|
|
- "File:/var/log/syslog"
|
|
- "File:/var/log/syslog.?"
|
|
logfiles:
|
|
category: logfile
|
|
sources:
|
|
- "File:*.log"
|
|
logfiles-appliances:
|
|
category: appliance
|
|
sources:
|
|
- "File:*.log"
|