security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Execution from Unusual Directory - Command Line (#1012)

Browse Source 
* [Rule Tuning] Execution from Unusual Directory - Command Line

* format change as per JLB sugg
This commit is contained in:
Samirbous
2021-03-19 10:16:47 +01:00
committed by GitHub
parent 511a74ef27
commit 04f3cd967d
1 changed files with 89 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/execution_from_unusual_path_cmdline.toml
+89 -16
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/10/30"
maturity = "production"
updated_date = "2021/03/03"
updated_date = "2021/03/09"
[rule]
author = ["Elastic"]
@@ -24,20 +24,93 @@ type = "eql"
query = '''
process where event.type in ("start", "process_started", "info") and
process.name : ("wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe","cmstp.exe","RegAsm.exe","installutil.exe","mshta.exe","RegSvcs.exe", "powershell.exe", "pwsh.exe", "cmd.exe") and
/* add suspicious execution paths here */
process.args : ("C:\\PerfLogs\\*","C:\\Users\\Public\\*","C:\\Users\\Default\\*","C:\\Windows\\Tasks\\*","C:\\Intel\\*", "C:\\AMD\\Temp\\*",
"C:\\Windows\\AppReadiness\\*", "C:\\Windows\\ServiceState\\*","C:\\Windows\\security\\*","C:\\Windows\\IdentityCRL\\*","C:\\Windows\\Branding\\*","C:\\Windows\\csc\\*",
"C:\\Windows\\DigitalLocker\\*","C:\\Windows\\en-US\\*","C:\\Windows\\wlansvc\\*","C:\\Windows\\Prefetch\\*","C:\\Windows\\Fonts\\*",
"C:\\Windows\\diagnostics\\*","C:\\Windows\\TAPI\\*","C:\\Windows\\INF\\*","C:\\Windows\\System32\\Speech\\*","C:\\windows\\tracing\\*",
"c:\\windows\\IME\\*","c:\\Windows\\Performance\\*","c:\\windows\\intel\\*","c:\\windows\\ms\\*","C:\\Windows\\dot3svc\\*","C:\\Windows\\ServiceProfiles\\*",
"C:\\Windows\\panther\\*","C:\\Windows\\RemotePackages\\*","C:\\Windows\\OCR\\*","C:\\Windows\\appcompat\\*","C:\\Windows\\apppatch\\*","C:\\Windows\\addins\\*",
"C:\\Windows\\Setup\\*","C:\\Windows\\Help\\*","C:\\Windows\\SKB\\*","C:\\Windows\\Vss\\*","C:\\Windows\\Web\\*","C:\\Windows\\servicing\\*","C:\\Windows\\CbsTemp\\*",
"C:\\Windows\\Logs\\*","C:\\Windows\\WaaS\\*","C:\\Windows\\twain_32\\*","C:\\Windows\\ShellExperiences\\*","C:\\Windows\\ShellComponents\\*","C:\\Windows\\PLA\\*",
"C:\\Windows\\Migration\\*","C:\\Windows\\debug\\*","C:\\Windows\\Cursors\\*","C:\\Windows\\Containers\\*","C:\\Windows\\Boot\\*","C:\\Windows\\bcastdvr\\*",
"C:\\Windows\\assembly\\*","C:\\Windows\\TextInput\\*","C:\\Windows\\security\\*","C:\\Windows\\schemas\\*","C:\\Windows\\SchCache\\*","C:\\Windows\\Resources\\*",
"C:\\Windows\\rescache\\*","C:\\Windows\\Provisioning\\*","C:\\Windows\\PrintDialog\\*","C:\\Windows\\PolicyDefinitions\\*","C:\\Windows\\media\\*",
"C:\\Windows\\Globalization\\*","C:\\Windows\\L2Schemas\\*","C:\\Windows\\LiveKernelReports\\*","C:\\Windows\\ModemLogs\\*","C:\\Windows\\ImmersiveControlPanel\\*",
"C:\\$Recycle.Bin\\*")
process.name : ("wscript.exe",
"cscript.exe",
"rundll32.exe",
"regsvr32.exe",
"cmstp.exe",
"RegAsm.exe",
"installutil.exe",
"mshta.exe",
"RegSvcs.exe",
"powershell.exe",
"pwsh.exe",
"cmd.exe") and
/* add suspicious execution paths here */
process.args : ("C:\\PerfLogs\\*",
"C:\\Users\\Public\\*",
"C:\\Users\\Default\\*",
"C:\\Windows\\Tasks\\*",
"C:\\Intel\\*",
"C:\\AMD\\Temp\\*",
"C:\\Windows\\AppReadiness\\*",
"C:\\Windows\\ServiceState\\*",
"C:\\Windows\\security\\*",
"C:\\Windows\\IdentityCRL\\*",
"C:\\Windows\\Branding\\*",
"C:\\Windows\\csc\\*",
"C:\\Windows\\DigitalLocker\\*",
"C:\\Windows\\en-US\\*",
"C:\\Windows\\wlansvc\\*",
"C:\\Windows\\Prefetch\\*",
"C:\\Windows\\Fonts\\*",
"C:\\Windows\\diagnostics\\*",
"C:\\Windows\\TAPI\\*",
"C:\\Windows\\INF\\*",
"C:\\Windows\\System32\\Speech\\*",
"C:\\windows\\tracing\\*",
"c:\\windows\\IME\\*",
"c:\\Windows\\Performance\\*",
"c:\\windows\\intel\\*",
"c:\\windows\\ms\\*",
"C:\\Windows\\dot3svc\\*",
"C:\\Windows\\ServiceProfiles\\*",
"C:\\Windows\\panther\\*",
"C:\\Windows\\RemotePackages\\*",
"C:\\Windows\\OCR\\*",
"C:\\Windows\\appcompat\\*",
"C:\\Windows\\apppatch\\*",
"C:\\Windows\\addins\\*",
"C:\\Windows\\Setup\\*",
"C:\\Windows\\Help\\*",
"C:\\Windows\\SKB\\*",
"C:\\Windows\\Vss\\*",
"C:\\Windows\\Web\\*",
"C:\\Windows\\servicing\\*",
"C:\\Windows\\CbsTemp\\*",
"C:\\Windows\\Logs\\*",
"C:\\Windows\\WaaS\\*",
"C:\\Windows\\twain_32\\*",
"C:\\Windows\\ShellExperiences\\*",
"C:\\Windows\\ShellComponents\\*",
"C:\\Windows\\PLA\\*",
"C:\\Windows\\Migration\\*",
"C:\\Windows\\debug\\*",
"C:\\Windows\\Cursors\\*",
"C:\\Windows\\Containers\\*",
"C:\\Windows\\Boot\\*",
"C:\\Windows\\bcastdvr\\*",
"C:\\Windows\\assembly\\*",
"C:\\Windows\\TextInput\\*",
"C:\\Windows\\security\\*",
"C:\\Windows\\schemas\\*",
"C:\\Windows\\SchCache\\*",
"C:\\Windows\\Resources\\*",
"C:\\Windows\\rescache\\*",
"C:\\Windows\\Provisioning\\*",
"C:\\Windows\\PrintDialog\\*",
"C:\\Windows\\PolicyDefinitions\\*",
"C:\\Windows\\media\\*",
"C:\\Windows\\Globalization\\*",
"C:\\Windows\\L2Schemas\\*",
"C:\\Windows\\LiveKernelReports\\*",
"C:\\Windows\\ModemLogs\\*",
"C:\\Windows\\ImmersiveControlPanel\\*",
"C:\\$Recycle.Bin\\*") and
not process.parent.executable : ("C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\*\\igfxCUIService*.exe",
"C:\\Windows\\System32\\spacedeskService.exe",
"C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe") and
not (process.name : "rundll32.exe" and process.args : ("uxtheme.dll,#64", "PRINTUI.DLL,PrintUIEntry"))
'''