security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Optimize query for Installation of Custom Shim Databases (#3331)

Browse Source 
* [Rule Tuning] Optimize query for Installation of Custom Shim Databases
* add timestamp override
* update query exceptions
* tighten endpoint index pattern to registry

---------

Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit aff7f37b92)
This commit is contained in:
Justin Ibarra
2023-12-14 13:04:08 -09:00
committed by github-actions[bot]
parent 35589e47a7
commit 5d5bb7ed16
1 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/persistence_app_compat_shim.toml
+11 -7
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/12/13"
[rule]
author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies the installation of custom Application Compatibility Shim databases.
abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"]
index = ["logs-endpoint.events.registry*", "winlogbeat-*", "logs-windows.*"]
language = "eql"
license = "Elastic License v2"
name = "Installation of Custom Shim Databases"
@@ -21,14 +21,18 @@ risk_score = 47
rule_id = "c5ce48a6-7f57-4ee8-9313-3d0024caee10"
severity = "medium"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
timestamp_override = "event.ingested"
type = "eql"
query = '''
sequence by process.entity_id with maxspan = 5m
[process where host.os.type == "windows" and event.type == "start" and
not (process.name : "sdbinst.exe" and process.parent.name : "msiexec.exe")]
[registry where host.os.type == "windows" and event.type in ("creation", "change") and
registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb"]
registry where host.os.type == "windows" and event.type in ("creation", "change") and
registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb" and
not process.executable :
("?:\\Program Files (x86)\\DesktopCentral_Agent\\swrepository\\1\\swuploads\\SAP-SLC\\SAPSetupSLC02_14-80001954\\Setup\\NwSapSetup.exe",
"?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
"?:\\Program Files (x86)\\SAP\\SAPsetup\\setup\\NwSapSetup.exe",
"?:\\Program Files (x86)\\SAP\\SapSetup\\OnRebootSvc\\NWSAPSetupOnRebootInstSvc.exe",
"?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfs.exe")
'''