From 04f3cd967da2923ba6931878673d33d813fc73f8 Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Fri, 19 Mar 2021 10:16:47 +0100 Subject: [PATCH] [Rule Tuning] Execution from Unusual Directory - Command Line (#1012) * [Rule Tuning] Execution from Unusual Directory - Command Line * format change as per JLB sugg --- .../execution_from_unusual_path_cmdline.toml | 105 +++++++++++++++--- 1 file changed, 89 insertions(+), 16 deletions(-) diff --git a/rules/windows/execution_from_unusual_path_cmdline.toml b/rules/windows/execution_from_unusual_path_cmdline.toml index b52d51400..5aaeb7207 100644 --- a/rules/windows/execution_from_unusual_path_cmdline.toml +++ b/rules/windows/execution_from_unusual_path_cmdline.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2020/10/30" maturity = "production" -updated_date = "2021/03/03" +updated_date = "2021/03/09" [rule] author = ["Elastic"] @@ -24,20 +24,93 @@ type = "eql" query = ''' process where event.type in ("start", "process_started", "info") and - process.name : ("wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe","cmstp.exe","RegAsm.exe","installutil.exe","mshta.exe","RegSvcs.exe", "powershell.exe", "pwsh.exe", "cmd.exe") and - /* add suspicious execution paths here */ -process.args : ("C:\\PerfLogs\\*","C:\\Users\\Public\\*","C:\\Users\\Default\\*","C:\\Windows\\Tasks\\*","C:\\Intel\\*", "C:\\AMD\\Temp\\*", - "C:\\Windows\\AppReadiness\\*", "C:\\Windows\\ServiceState\\*","C:\\Windows\\security\\*","C:\\Windows\\IdentityCRL\\*","C:\\Windows\\Branding\\*","C:\\Windows\\csc\\*", - "C:\\Windows\\DigitalLocker\\*","C:\\Windows\\en-US\\*","C:\\Windows\\wlansvc\\*","C:\\Windows\\Prefetch\\*","C:\\Windows\\Fonts\\*", - "C:\\Windows\\diagnostics\\*","C:\\Windows\\TAPI\\*","C:\\Windows\\INF\\*","C:\\Windows\\System32\\Speech\\*","C:\\windows\\tracing\\*", - "c:\\windows\\IME\\*","c:\\Windows\\Performance\\*","c:\\windows\\intel\\*","c:\\windows\\ms\\*","C:\\Windows\\dot3svc\\*","C:\\Windows\\ServiceProfiles\\*", - "C:\\Windows\\panther\\*","C:\\Windows\\RemotePackages\\*","C:\\Windows\\OCR\\*","C:\\Windows\\appcompat\\*","C:\\Windows\\apppatch\\*","C:\\Windows\\addins\\*", - "C:\\Windows\\Setup\\*","C:\\Windows\\Help\\*","C:\\Windows\\SKB\\*","C:\\Windows\\Vss\\*","C:\\Windows\\Web\\*","C:\\Windows\\servicing\\*","C:\\Windows\\CbsTemp\\*", - "C:\\Windows\\Logs\\*","C:\\Windows\\WaaS\\*","C:\\Windows\\twain_32\\*","C:\\Windows\\ShellExperiences\\*","C:\\Windows\\ShellComponents\\*","C:\\Windows\\PLA\\*", - "C:\\Windows\\Migration\\*","C:\\Windows\\debug\\*","C:\\Windows\\Cursors\\*","C:\\Windows\\Containers\\*","C:\\Windows\\Boot\\*","C:\\Windows\\bcastdvr\\*", - "C:\\Windows\\assembly\\*","C:\\Windows\\TextInput\\*","C:\\Windows\\security\\*","C:\\Windows\\schemas\\*","C:\\Windows\\SchCache\\*","C:\\Windows\\Resources\\*", - "C:\\Windows\\rescache\\*","C:\\Windows\\Provisioning\\*","C:\\Windows\\PrintDialog\\*","C:\\Windows\\PolicyDefinitions\\*","C:\\Windows\\media\\*", - "C:\\Windows\\Globalization\\*","C:\\Windows\\L2Schemas\\*","C:\\Windows\\LiveKernelReports\\*","C:\\Windows\\ModemLogs\\*","C:\\Windows\\ImmersiveControlPanel\\*", - "C:\\$Recycle.Bin\\*") + process.name : ("wscript.exe", + "cscript.exe", + "rundll32.exe", + "regsvr32.exe", + "cmstp.exe", + "RegAsm.exe", + "installutil.exe", + "mshta.exe", + "RegSvcs.exe", + "powershell.exe", + "pwsh.exe", + "cmd.exe") and + + /* add suspicious execution paths here */ + process.args : ("C:\\PerfLogs\\*", + "C:\\Users\\Public\\*", + "C:\\Users\\Default\\*", + "C:\\Windows\\Tasks\\*", + "C:\\Intel\\*", + "C:\\AMD\\Temp\\*", + "C:\\Windows\\AppReadiness\\*", + "C:\\Windows\\ServiceState\\*", + "C:\\Windows\\security\\*", + "C:\\Windows\\IdentityCRL\\*", + "C:\\Windows\\Branding\\*", + "C:\\Windows\\csc\\*", + "C:\\Windows\\DigitalLocker\\*", + "C:\\Windows\\en-US\\*", + "C:\\Windows\\wlansvc\\*", + "C:\\Windows\\Prefetch\\*", + "C:\\Windows\\Fonts\\*", + "C:\\Windows\\diagnostics\\*", + "C:\\Windows\\TAPI\\*", + "C:\\Windows\\INF\\*", + "C:\\Windows\\System32\\Speech\\*", + "C:\\windows\\tracing\\*", + "c:\\windows\\IME\\*", + "c:\\Windows\\Performance\\*", + "c:\\windows\\intel\\*", + "c:\\windows\\ms\\*", + "C:\\Windows\\dot3svc\\*", + "C:\\Windows\\ServiceProfiles\\*", + "C:\\Windows\\panther\\*", + "C:\\Windows\\RemotePackages\\*", + "C:\\Windows\\OCR\\*", + "C:\\Windows\\appcompat\\*", + "C:\\Windows\\apppatch\\*", + "C:\\Windows\\addins\\*", + "C:\\Windows\\Setup\\*", + "C:\\Windows\\Help\\*", + "C:\\Windows\\SKB\\*", + "C:\\Windows\\Vss\\*", + "C:\\Windows\\Web\\*", + "C:\\Windows\\servicing\\*", + "C:\\Windows\\CbsTemp\\*", + "C:\\Windows\\Logs\\*", + "C:\\Windows\\WaaS\\*", + "C:\\Windows\\twain_32\\*", + "C:\\Windows\\ShellExperiences\\*", + "C:\\Windows\\ShellComponents\\*", + "C:\\Windows\\PLA\\*", + "C:\\Windows\\Migration\\*", + "C:\\Windows\\debug\\*", + "C:\\Windows\\Cursors\\*", + "C:\\Windows\\Containers\\*", + "C:\\Windows\\Boot\\*", + "C:\\Windows\\bcastdvr\\*", + "C:\\Windows\\assembly\\*", + "C:\\Windows\\TextInput\\*", + "C:\\Windows\\security\\*", + "C:\\Windows\\schemas\\*", + "C:\\Windows\\SchCache\\*", + "C:\\Windows\\Resources\\*", + "C:\\Windows\\rescache\\*", + "C:\\Windows\\Provisioning\\*", + "C:\\Windows\\PrintDialog\\*", + "C:\\Windows\\PolicyDefinitions\\*", + "C:\\Windows\\media\\*", + "C:\\Windows\\Globalization\\*", + "C:\\Windows\\L2Schemas\\*", + "C:\\Windows\\LiveKernelReports\\*", + "C:\\Windows\\ModemLogs\\*", + "C:\\Windows\\ImmersiveControlPanel\\*", + "C:\\$Recycle.Bin\\*") and + not process.parent.executable : ("C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\*\\igfxCUIService*.exe", + "C:\\Windows\\System32\\spacedeskService.exe", + "C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe") and + not (process.name : "rundll32.exe" and process.args : ("uxtheme.dll,#64", "PRINTUI.DLL,PrintUIEntry")) '''