security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Ignore Windows Update MpSigStub.exe for Parent Process PID Spoofing (#3025)

Browse Source 
* adding tuning to ignore windows update

* Update privilege_escalation_via_ppid_spoofing.toml

* Update privilege_escalation_via_ppid_spoofing.toml

---------

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
This commit is contained in:
Terrance DeJesus
2023-08-22 13:04:25 -04:00
committed by GitHub
parent 0c3b251208
commit 2ddcf7817e
1 changed files with 26 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/privilege_escalation_via_ppid_spoofing.toml
+26 -4
View File
@@ -4,7 +4,7 @@ integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/23"
updated_date = "2023/08/22"
[rule]
author = ["Elastic"]
@@ -51,15 +51,37 @@ process where host.os.type == "windows" and event.action == "start" and
"?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe") and
/* Logon Utilities */
not (process.parent.executable : "?:\\Windows\\System32\\Utilman.exe" and
process.executable : ("?:\\Windows\\System32\\osk.exe",
"?:\\Windows\\System32\\Narrator.exe",
process.executable : ("?:\\Windows\\System32\\osk.exe",
"?:\\Windows\\System32\\Narrator.exe",
"?:\\Windows\\System32\\Magnify.exe")) and
not process.parent.executable : "?:\\Windows\\System32\\AtBroker.exe" and
not (process.code_signature.subject_name in
("philandro Software GmbH", "Freedom Scientific Inc.", "TeamViewer Germany GmbH", "Projector.is, Inc.",
"TeamViewer GmbH", "Cisco WebEx LLC", "Dell Inc") and process.code_signature.trusted == true)
"TeamViewer GmbH", "Cisco WebEx LLC", "Dell Inc") and process.code_signature.trusted == true) and
/* AM_Delta_Patch Windows Update */
not (process.executable : ("?:\\Windows\\System32\\MpSigStub.exe", "?:\\Windows\\SysWOW64\\MpSigStub.exe") and
process.parent.executable : ("?:\\Windows\\System32\\wuauclt.exe",
"?:\\Windows\\SysWOW64\\wuauclt.exe",
"?:\\Windows\\UUS\\Packages\\Preview\\*\\wuaucltcore.exe",
"?:\\Windows\\UUS\\amd64\\wuauclt.exe",
"?:\\Windows\\UUS\\amd64\\wuaucltcore.exe",
"?:\\ProgramData\\Microsoft\\Windows\\UUS\\*\\wuaucltcore.exe")) and
not (process.executable : ("?:\\Windows\\System32\\MpSigStub.exe", "?:\\Windows\\SysWOW64\\MpSigStub.exe") and process.parent.executable == null) and
/* Other third party SW */
not process.parent.executable :
("?:\\Program Files (x86)\\HEAT Software\\HEAT Remote\\HEATRemoteServer.exe",
"?:\\Program Files (x86)\\VisualCron\\VisualCronService.exe",
"?:\\Program Files\\BinaryDefense\\Vision\\Agent\\bds-vision-agent-app.exe",
"?:\\Program Files\\Tablet\\Wacom\\WacomHost.exe",
"?:\\Program Files (x86)\\LogMeIn\\x64\\LogMeIn.exe",
"?:\\Program Files (x86)\\EMC Captiva\\Captiva Cloud Runtime\\Emc.Captiva.WebCaptureRunner.exe",
"?:\\Program Files\\Freedom Scientific\\*.exe",
"?:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\*\\remoting_host.exe",
"?:\\Program Files (x86)\\GoToAssist Remote Support Customer\\*\\g2ax_comm_customer.exe")
'''