[New Rule] Unsigned DLL Side-Loading from a Suspicious Folder (#2409)

* Create defense_evasion_unsigned_dll_loaded_from_suspdir.toml * Update non-ecs-schema.json * Update defense_evasion_unsigned_dll_loaded_from_suspdir.toml * Update rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
2023-01-25 13:23:20 +00:00
parent 8427c8cd22
commit bcd8ef15ba
2 changed files with 139 additions and 1 deletions
@@ -67,7 +67,9 @@
    "process.Ext.effective_parent.executable": "keyword",
    "file.Ext.header_bytes": "keyword", 
    "file.Ext.entropy": "long",
-    "file.size": "long"
+    "file.size": "long",
+    "dll.Ext.relative_file_creation_time": "long",
+    "dll.Ext.relative_file_name_modify_time": "long"
  },
  "logs-windows.*": {
    "powershell.file.script_block_text": "text"
@@ -0,0 +1,136 @@
+[metadata]
+creation_date = "2022/11/22"
+maturity = "production"
+integration = ["endpoint"]
+min_stack_comments = "New fields added: required_fields, related_integrations, setup"
+min_stack_version = "8.4.0"
+updated_date = "2022/11/22"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted
+program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading 
+a malicious DLL within the memory space of a signed processes.
+"""
+from = "now-9m"
+index = ["logs-endpoint.events.*"]
+language = "eql"
+license = "Elastic License v2"
+name = "Unsigned DLL Side-Loading from a Suspicious Folder"
+note = """## Setup
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
+"""
+risk_score = 47
+rule_id = "ca98c7cf-a56e-4057-a4e8-39603f7f0389"
+severity = "medium"
+tags = ["Elastic", "Host", "Windows", "Threat Detection", "Defense Evasion"]
+timestamp_override = "event.ingested"
+type = "eql"
+
+query = '''
+library where 
+
+ process.code_signature.trusted == true and 
+ 
+ (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and 
+ 
+  not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*", "errorChaining") and 
+  
+      /* Suspicious Paths */
+      dll.path : ("?:\\PerfLogs\\*.dll",
+                  "?:\\Users\\*\\Pictures\\*.dll",
+                  "?:\\Users\\*\\Music\\*.dll",
+                  "?:\\Users\\Public\\*.dll",
+                  "?:\\Users\\*\\Documents\\*.dll",
+                  "?:\\Windows\\Tasks\\*.dll",
+                  "?:\\Windows\\System32\\Tasks\\*.dll",
+                  "?:\\Intel\\*.dll",
+                  "?:\\AMD\\Temp\\*.dll",
+                  "?:\\Windows\\AppReadiness\\*.dll",
+                  "?:\\Windows\\ServiceState\\*.dll",
+                  "?:\\Windows\\security\\*.dll",
+		  "?:\\Windows\\System\\*.dll",
+                  "?:\\Windows\\IdentityCRL\\*.dll",
+                  "?:\\Windows\\Branding\\*.dll",
+                  "?:\\Windows\\csc\\*.dll",
+                  "?:\\Windows\\DigitalLocker\\*.dll",
+                  "?:\\Windows\\en-US\\*.dll",
+                  "?:\\Windows\\wlansvc\\*.dll",
+                  "?:\\Windows\\Prefetch\\*.dll",
+                  "?:\\Windows\\Fonts\\*.dll",
+                  "?:\\Windows\\diagnostics\\*.dll",
+                  "?:\\Windows\\TAPI\\*.dll",
+                  "?:\\Windows\\INF\\*.dll",
+                  "?:\\windows\\tracing\\*.dll",
+                  "?:\\windows\\IME\\*.dll",
+                  "?:\\Windows\\Performance\\*.dll",
+                  "?:\\windows\\intel\\*.dll",
+                  "?:\\windows\\ms\\*.dll",
+                  "?:\\Windows\\dot3svc\\*.dll",
+                  "?:\\Windows\\ServiceProfiles\\*.dll",
+                  "?:\\Windows\\panther\\*.dll",
+                  "?:\\Windows\\RemotePackages\\*.dll",
+                  "?:\\Windows\\OCR\\*.dll",
+                  "?:\\Windows\\appcompat\\*.dll",
+                  "?:\\Windows\\apppatch\\*.dll",
+                  "?:\\Windows\\addins\\*.dll",
+                  "?:\\Windows\\Setup\\*.dll",
+                  "?:\\Windows\\Help\\*.dll",
+                  "?:\\Windows\\SKB\\*.dll",
+                  "?:\\Windows\\Vss\\*.dll",
+                  "?:\\Windows\\Web\\*.dll",
+                  "?:\\Windows\\servicing\\*.dll",
+                  "?:\\Windows\\CbsTemp\\*.dll",
+                  "?:\\Windows\\Logs\\*.dll",
+                  "?:\\Windows\\WaaS\\*.dll",
+                  "?:\\Windows\\twain_32\\*.dll",
+                  "?:\\Windows\\ShellExperiences\\*.dll",
+                  "?:\\Windows\\ShellComponents\\*.dll",
+                  "?:\\Windows\\PLA\\*.dll",
+                  "?:\\Windows\\Migration\\*.dll",
+                  "?:\\Windows\\debug\\*.dll",
+                  "?:\\Windows\\Cursors\\*.dll",
+                  "?:\\Windows\\Containers\\*.dll",
+                  "?:\\Windows\\Boot\\*.dll",
+                  "?:\\Windows\\bcastdvr\\*.dll",
+                  "?:\\Windows\\TextInput\\*.dll",
+                  "?:\\Windows\\schemas\\*.dll",
+                  "?:\\Windows\\SchCache\\*.dll",
+                  "?:\\Windows\\Resources\\*.dll",
+                  "?:\\Windows\\rescache\\*.dll",
+                  "?:\\Windows\\Provisioning\\*.dll",
+                  "?:\\Windows\\PrintDialog\\*.dll",
+                  "?:\\Windows\\PolicyDefinitions\\*.dll",
+                  "?:\\Windows\\media\\*.dll",
+                  "?:\\Windows\\Globalization\\*.dll",
+                  "?:\\Windows\\L2Schemas\\*.dll",
+                  "?:\\Windows\\LiveKernelReports\\*.dll",
+                  "?:\\Windows\\ModemLogs\\*.dll",
+                  "?:\\Windows\\ImmersiveControlPanel\\*.dll",
+                  "?:\\$Recycle.Bin\\*.dll") and 
+	 
+	 /* DLL loaded from the process.executable current directory */
+	 endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[rule.threat.technique.subtechnique]]
+id = "T1574.002"
+name = "DLL Side-Loading"
+reference = "https://attack.mitre.org/techniques/T1574/002/"
+
+
+
+[rule.threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+