security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[New Rule] Building Block Rules - Part 2 (#2923)

Browse Source 
* [New Rule] Building Block Rules - Part 2

* .

* Update rules_building_block/defense_evasion_dll_hijack.toml

* Update rules_building_block/defense_evasion_file_permission_modification.toml

* Update rules_building_block/discovery_posh_password_policy.toml

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

(cherry picked from commit 9144dc0448)
This commit is contained in:
Jonhnathan
2023-08-17 13:00:50 -03:00
committed by github-actions[bot]
parent 44ac8f762d
commit 7c4ca0a4a3
7 changed files with 346 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detection_rules/etc/non-ecs-schema.json
+1
View File
@@ -71,6 +71,7 @@
"file.Ext.entropy": "long",
"file.size": "long",
"file.Ext.original.name": "keyword",
"dll.Ext.device.product_id": "keyword",
"dll.Ext.relative_file_creation_time": "double",
"dll.Ext.relative_file_name_modify_time": "double",
"process.Ext.relative_file_name_modify_time": "double",
rules/windows/discovery_system_service_discovery.toml
+3 -2
View File
@@ -4,7 +4,7 @@ integration = ["windows", "endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/06/22"
updated_date = "2023/07/12"
[rule]
author = ["Elastic"]
@@ -29,7 +29,8 @@ process where host.os.type == "windows" and event.type == "start" and
(
((process.name: "net.exe" or process.pe.original_file_name == "net.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe")) and process.args : ("start", "use") and process.args_count == 2) or
((process.name: "sc.exe" or process.pe.original_file_name == "sc.exe") and process.args: ("query", "q*")) or
((process.name: "tasklist.exe" or process.pe.original_file_name == "tasklist.exe") and process.args: "/svc")
((process.name: "tasklist.exe" or process.pe.original_file_name == "tasklist.exe") and process.args: "/svc") or
(process.name : "psservice.exe" or process.pe.original_file_name == "psservice.exe")
) and not user.id : "S-1-5-18"
'''
rules_building_block/defense_evasion_dll_hijack.toml
+65
View File
@@ -0,0 +1,65 @@
[metadata]
creation_date = "2023/07/12"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/07/12"
[rule]
author = ["Elastic"]
description = """
Identifies digitally signed (trusted) processes loading unsigned DLLs. Attackers may plant their payloads into the
application folder and invoke the legitimate application to execute the payload, masking actions they perform under a
legitimate, trusted, and potentially elevated system or software process.
"""
from = "now-119m"
interval = "60m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Unsigned DLL Loaded by a Trusted Process"
risk_score = 21
rule_id = "c20cd758-07b1-46a1-b03f-fa66158258b8"
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR"]
timestamp_override = "event.ingested"
building_block_type = "default"
type = "eql"
query = '''
library where host.os.type == "windows" and
(dll.Ext.relative_file_creation_time <= 500 or
dll.Ext.relative_file_name_modify_time <= 500 or
dll.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk")) and dll.hash.sha256 != null and
process.code_signature.status :"trusted" and not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
/* DLL loaded from the process.executable current directory */
endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))
and not user.id : "S-1-5-18"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[rule.threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL Search Order Hijacking"
reference = "https://attack.mitre.org/techniques/T1574/001/"
[[rule.threat.technique.subtechnique]]
id = "T1574.002"
name = "DLL Side-Loading"
reference = "https://attack.mitre.org/techniques/T1574/002/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules_building_block/defense_evasion_file_permission_modification.toml
+56
View File
@@ -0,0 +1,56 @@
[metadata]
creation_date = "2023/07/12"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/07/12"
[rule]
author = ["Elastic"]
description = """
Identifies the change of permissions/ownership of files/folders through built-in Windows utilities. Threat actors may
require permission modification of files/folders to change, modify or delete them.
"""
from = "now-119m"
interval = "60m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "File and Directory Permissions Modification"
risk_score = 21
rule_id = "bc9e4f5a-e263-4213-a2ac-1edf9b417ada"
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Rule Type: BBR"]
timestamp_override = "event.ingested"
building_block_type = "default"
type = "eql"
query = '''
process where event.type == "start" and host.os.type == "windows" and
(
((process.name: "icacls.exe" or process.pe.original_file_name == "iCACLS.EXE") and process.args: ("*:F", "/reset", "/setowner", "*grant*")) or
((process.name: "cacls.exe" or process.pe.original_file_name == "CACLS.EXE") and process.args: ("/g", "*:f")) or
((process.name: "takeown.exe" or process.pe.original_file_name == "takeown.exe") and process.args: ("/F")) or
((process.name: "attrib.exe" or process.pe.original_file_name== "ATTRIB.EXE") and process.args: "-r")
) and not user.id : "S-1-5-18"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1222"
name = "File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/"
[[rule.threat.technique.subtechnique]]
id = "T1222.001"
name = "Windows File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/001/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules_building_block/discovery_internet_capabilities.toml
+51
View File
@@ -0,0 +1,51 @@
[metadata]
creation_date = "2023/07/12"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/07/12"
[rule]
author = ["Elastic"]
description = """
Identifies the use of built-in tools attackers can use to check for Internet connectivity on compromised systems. These
results may be used to determine communication capabilities with C2 servers, or to identify routes, redirectors, and
proxy servers.
"""
from = "now-119m"
interval = "60m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Discovery of Internet Capabilities via Built-in Tools"
risk_score = 21
rule_id = "7f89afef-9fc5-4e7b-bf16-75ffdf27f8db"
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: Elastic Endgame", "Rule Type: BBR"]
timestamp_override = "event.ingested"
type = "eql"
building_block_type = "default"
query = '''
process where host.os.type == "windows" and event.type == "start" and
process.name : ("ping.exe", "tracert.exe", "pathping.exe") and
not process.args : ("127.0.0.1", "::1", "0.0.0.0", "192.168.*")
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1016"
name = "System Network Configuration Discovery"
reference = "https://attack.mitre.org/techniques/T1016/"
[[rule.threat.technique.subtechnique]]
id = "T1016.001"
name = "Internet Connection Discovery"
reference = "https://attack.mitre.org/techniques/T1016/001/"
[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
rules_building_block/discovery_posh_password_policy.toml
+94
View File
@@ -0,0 +1,94 @@
[metadata]
creation_date = "2023/07/12"
integration = ["windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/07/12"
[rule]
author = ["Elastic"]
description = """
Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM
to perform lateral movement using built-in tools.
"""
from = "now-119m"
interval = "60m"
index = ["winlogbeat-*", "logs-windows.*"]
language = "kuery"
license = "Elastic License v2"
name = "PowerShell Script with Password Policy Discovery Capabilities"
note = """## Setup
The 'PowerShell Script Block Logging' logging policy must be enabled.
Steps to implement the logging policy with Advanced Audit Configuration:
```
Computer Configuration >
Administrative Templates >
Windows PowerShell >
Turn on PowerShell Script Block Logging (Enable)
```
Steps to implement the logging policy via registry:
```
reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
```
"""
risk_score = 21
rule_id = "fe25d5bc-01fa-494a-95ff-535c29cc4c96"
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Discovery", "Data Source: PowerShell Logs", "Rule Type: BBR"]
timestamp_override = "event.ingested"
type = "query"
building_block_type = "default"
query = '''
event.category: "process" and host.os.type:windows and
(
powershell.file.script_block_text: (
"Get-ADDefaultDomainPasswordPolicy" or
"Get-ADFineGrainedPasswordPolicy" or
"Get-ADUserResultantPasswordPolicy" or
"Get-DomainPolicy" or
"Get-GPPPassword" or
"Get-PassPol"
)
or
powershell.file.script_block_text: (
("defaultNamingContext" or "ActiveDirectory.DirectoryContext" or "ActiveDirectory.DirectorySearcher") and
(
(
".MinLengthPassword" or
".MinPasswordAge" or
".MaxPasswordAge"
) or
(
"minPwdAge" or
"maxPwdAge" or
"minPwdLength"
) or
(
"msDS-PasswordSettings"
)
)
)
) and not powershell.file.script_block_text : (
"sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
)
and not user.id : "S-1-5-18"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1201"
name = "Password Policy Discovery"
reference = "https://attack.mitre.org/techniques/T1201/"
[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
rules_building_block/lateral_movement_posh_winrm_activity.toml
+76
View File
@@ -0,0 +1,76 @@
[metadata]
creation_date = "2023/07/12"
integration = ["windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/07/12"
[rule]
author = ["Elastic"]
description = """
Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM
to perform lateral movement using built-in tools.
"""
from = "now-119m"
interval = "60m"
index = ["winlogbeat-*", "logs-windows.*"]
language = "kuery"
license = "Elastic License v2"
name = "PowerShell Script with Remote Execution Capabilities via WinRM"
note = """## Setup
The 'PowerShell Script Block Logging' logging policy must be enabled.
Steps to implement the logging policy with Advanced Audit Configuration:
```
Computer Configuration >
Administrative Templates >
Windows PowerShell >
Turn on PowerShell Script Block Logging (Enable)
```
Steps to implement the logging policy via registry:
```
reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
```
"""
references = [
"https://attack.mitre.org/techniques/T1021/006/",
"https://github.com/cobbr/SharpSploit/blob/master/SharpSploit/LateralMovement/PowerShellRemoting.cs",
"https://github.com/BC-SECURITY/Empire/blob/main/empire/server/modules/powershell/lateral_movement/invoke_psremoting.py"
]
risk_score = 21
rule_id = "0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83"
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: PowerShell Logs", "Rule Type: BBR"]
timestamp_override = "event.ingested"
type = "query"
building_block_type = "default"
query = '''
event.category:process and host.os.type:windows and
powershell.file.script_block_text : (
("Invoke-WmiMethod" or "Invoke-Command" or "Enter-PSSession") and "ComputerName"
)
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[rule.threat.technique.subtechnique]]
id = "T1021.006"
name = "Windows Remote Management"
reference = "https://attack.mitre.org/techniques/T1021/006/"
[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"