Nasreddine Bencherchali
e230acd7ed
new: Application Terminated Via Wmic.EXE new: Browser Execution In Headless Mode new: Chromium Browser Headless Execution To Mockbin Like Site new: DarkGate User Created Via Net.EXE new: DMP/HDMP File Creation new: Malicious Driver Load new: Malicious Driver Load By Name new: Potentially Suspicious DMP/HDMP File Creation new: Remote DLL Load Via Rundll32.EXE new: Renamed CURL.EXE Execution new: Vulnerable Driver Load new: Vulnerable Driver Load By Name update: 7Zip Compressing Dump Files - Increase coverage update: Amsi.DLL Loaded Via LOLBIN Process - Reduce level to `medium` update: COM Hijack via Sdclt - Fix Logic update: Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE - Increase coverage update: Creation of an Executable by an Executable - Fix FP update: DLL Load By System Process From Suspicious Locations - Reduce level to `medium` update: DNS Query Request By Regsvr32.EXE - Reduce level to `medium` update: DNS Query To MEGA Hosting Website - DNS Client - Update title and reduce level to `medium` update: DNS Query To MEGA Hosting Website - Reduce level to `low` and update metadata update: DNS Query To Remote Access Software Domain From Non-Browser App - Increase coverage with new domains update: DNS Query To Ufile.io - DNS Client - Update title and reduce level to `low` update: DNS Query To Ufile.io - Update title and reduce level to `low` update: DNS Query Tor .Onion Address - Sysmon - Update title update: DNS Server Discovery Via LDAP Query - Reduce level to `low` and update FP filters update: DriverQuery.EXE Execution - Increase coverage update: File Download From Browser Process Via Inline Link update: Greedy File Deletion Using Del - Increase coverage update: Leviathan Registry Key Activity - Fix logic update: Network Connection Initiated By Regsvr32.EXE - Reduce level to `medium` and metadata update update: Non Interactive PowerShell Process Spawned - Increase coverage update: OceanLotus Registry Activity - Fix Logic update: Office Application Startup - Office Test - Fix Logic update: OneNote Attachment File Dropped In Suspicious Location - Fix FP update: Potential Dead Drop Resolvers - Increase coverage with new domains update: Potential Persistence Via COM Hijacking From Suspicious Locations - Increase coverage and fix logic update: Potential Persistence Via COM Search Order Hijacking - Fix Logic update: Potential Process Hollowing Activity - Update FP filters update: Potential Recon Activity Using DriverQuery.EXE - Increase coverage update: Potential Unquoted Service Path Reconnaissance Via Wmic.EXE - Reduce level to `medium` update: Potentially Suspicious Event Viewer Child Process - Update metadata update: PowerShell Initiated Network Connection - Update description update: PowerShell Module File Created By Non-PowerShell Process - Fix FP update: PsExec Tool Execution From Suspicious Locations - PipeName - Reduce level to `medium` update: Python Image Load By Non-Python Process - Update description and title update: Python Initiated Connection - Update FP filter update: Remote Thread Creation By Uncommon Source Image - Update FP filter update: Renamed AutoIt Execution - Increase coverage update: Suspicious Chromium Browser Instance Executed With Custom Extensions - Increase coverage update: Suspicious WebDav Client Execution Via Rundll32.EXE - New Title update: Sysinternals Tools AppX Versions Execution - Reduce level to `low` update: Sysmon Blocked Executable - Update logsource update: UAC Bypass via Event Viewer - Fix Logic update: UNC2452 Process Creation Patterns - Fix logic update: Usage Of Malicious POORTRY Signed Driver - Deprecated update: Vulnerable AVAST Anti Rootkit Driver Load - Deprecated update: Vulnerable Dell BIOS Update Driver Load - Deprecated update: Vulnerable Driver Load By Name - Deprecated update: Vulnerable GIGABYTE Driver Load - Deprecated update: Vulnerable HW Driver Load - Deprecated update: Vulnerable Lenovo Driver Load - Deprecated update: WebDav Client Execution Via Rundll32.EXE update: Windows Update Error - Reduce level to `informational` and status to `stable` update: Winrar Compressing Dump Files - Increase Coverage --------- Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
41 lines
2.0 KiB
YAML
41 lines
2.0 KiB
YAML
title: Python Initiated Connection
|
|
id: bef0bc5a-b9ae-425d-85c6-7b2d705980c6
|
|
status: experimental
|
|
description: Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
|
|
references:
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python
|
|
- https://pypi.org/project/scapy/
|
|
author: frack113
|
|
date: 2021/12/10
|
|
modified: 2023/09/07
|
|
tags:
|
|
- attack.discovery
|
|
- attack.t1046
|
|
logsource:
|
|
category: network_connection
|
|
product: windows
|
|
detection:
|
|
selection:
|
|
Initiated: 'true'
|
|
Image|contains: 'python'
|
|
filter_optional_conda:
|
|
# Related to anaconda updates. Command example: "conda update conda"
|
|
# This filter will only work with aurora agent enriched data as Sysmon EID 3 doesn't contain CommandLine nor ParentImage
|
|
ParentImage: C:\ProgramData\Anaconda3\Scripts\conda.exe
|
|
CommandLine|contains|all:
|
|
- ':\ProgramData\Anaconda3\Scripts\conda-script.py'
|
|
- 'update'
|
|
filter_optional_conda_jupyter_notebook:
|
|
# Related to anaconda opening an instance of Jupyter Notebook
|
|
# This filter will only work with aurora agent enriched data as Sysmon EID 3 doesn't contain CommandLine nor ParentImage
|
|
ParentImage: C:\ProgramData\Anaconda3\python.exe
|
|
CommandLine|contains: 'C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py'
|
|
filter_main_local_communication:
|
|
# This could be caused when launching an instance of Jupyter Notebook locally for example but can also be caused by other instances of python opening sockets locally etc. So comment this out if you want to monitor for those instances
|
|
DestinationIp: 127.0.0.1
|
|
SourceIp: 127.0.0.1
|
|
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
|
|
falsepositives:
|
|
- Legitimate python script
|
|
level: medium
|