[New Rule] WMI Incoming Lateral Movement (#532)

* [New Rule] WMI Incoming Lateral Movement * Update rules/windows/lateral_movement_incoming_wmi.toml Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com> * cirdrmatch returned error on 7.10 replaced by != * Update rules/windows/lateral_movement_incoming_wmi.toml Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> * eql syntax * ecs_version Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com> Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
2020-12-08 16:57:41 +01:00
parent 16551bbfe7
commit bd2006d70d
1 changed files with 56 additions and 0 deletions
@@ -0,0 +1,56 @@
+[metadata]
+creation_date = "2020/11/15"
+maturity = "production"
+updated_date = "2020/11/15"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies processes executed via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of
+adversary lateral movement, but could be noisy if administrators use WMI to remotely manage hosts.
+"""
+from = "now-9m"
+index = ["logs-endpoint.events.*", "winlogbeat-*"]
+language = "eql"
+license = "Elastic License"
+name = "WMI Incoming Lateral Movement"
+risk_score = 47
+rule_id = "f3475224-b179-4f78-8877-c2bd64c26b88"
+severity = "medium"
+tags = ["Elastic", "Host", "Windows", "Threat Detection", "Lateral Movement"]
+type = "eql"
+
+query = '''
+sequence by host.id with maxspan = 2s
+
+ /* Accepted Incoming RPC connection by Winmgmt service */
+
+  [network where process.name : "svchost.exe" and network.direction == "incoming" and
+   source.address != "127.0.0.1" and source.address != "::1" and 
+   source.port >= 49152 and destination.port >= 49152
+  ]
+
+  /* Excluding Common FPs Nessus and SCCM */
+
+  [process where event.type in ("start", "process_started") and process.parent.name : "WmiPrvSE.exe" and
+   not process.args : ("C:\\windows\\temp\\nessus_*.txt", 
+                       "C:\\windows\\TEMP\\nessus_*.TMP", 
+                       "C:\\Windows\\CCM\\SystemTemp\\*", 
+                       "C:\\Windows\\CCMCache\\*", 
+                       "C:\\CCM\\Cache\\*")
+   ]
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1047"
+name = "Windows Management Instrumentation"
+reference = "https://attack.mitre.org/techniques/T1047/"
+
+
+[rule.threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"