security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[New Rule] New BBR Rules - Part 2 (#3029)

Browse Source 
* [New Rule] New BBR Rules - Part 2

* Update discovery_generic_account_groups.toml

* Update discovery_generic_account_groups.toml

* Update rules_building_block/defense_evasion_cmd_copy_binary_contents.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/execution_downloaded_shortcut_files.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update rules_building_block/defense_evasion_cmd_copy_binary_contents.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update rules_building_block/defense_evasion_unusual_process_extension.toml

Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>

* Update defense_evasion_unusual_process_extension.toml

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com>
This commit is contained in:
Jonhnathan
2023-09-12 21:49:22 -03:00
committed by GitHub
parent af99186992
commit ddb1f75352
6 changed files with 247 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/persistence_registry_uncommon.toml
+8 -1
View File
@@ -102,7 +102,14 @@ id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"
[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[rule.threat.technique.subtechnique]]
id = "T1546.002"
name = "Screensaver"
reference = "https://attack.mitre.org/techniques/T1546/002/"
[rule.threat.tactic]
id = "TA0003"
rules_building_block/defense_evasion_cmd_copy_binary_contents.toml
+48
View File
@@ -0,0 +1,48 @@
[metadata]
creation_date = "2023/08/23"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/08/23"
[rule]
author = ["Elastic"]
description = """
Attackers may abuse cmd.exe commands to reassemble binary fragments into a malicious payload.
"""
from = "now-119m"
interval = "60m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Binary Content Copy via Cmd.exe"
risk_score = 21
rule_id = "53dedd83-1be7-430f-8026-363256395c8b"
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"]
timestamp_override = "event.ingested"
type = "eql"
building_block_type = "default"
query = '''
process where host.os.type == "windows" and event.type == "start" and
process.name : "cmd.exe" and (
(process.args : "type" and process.args : (">", ">>")) or
(process.args : "copy" and process.args : "/b"))
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules_building_block/defense_evasion_unusual_process_extension.toml
+60
View File
@@ -0,0 +1,60 @@
[metadata]
creation_date = "2023/08/23"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/08/23"
[rule]
author = ["Elastic"]
description = """
Identifies processes running with unusual extensions that are not typically valid for Windows executables.
"""
from = "now-119m"
interval = "60m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Unusual Process Extension"
risk_score = 21
rule_id = "800e01be-a7a4-46d0-8de9-69f3c9582b44"
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"]
timestamp_override = "event.ingested"
type = "eql"
building_block_type = "default"
query = '''
process where host.os.type == "windows" and event.type == "start" and
process.executable : "?*" and
not process.name : ("*.exe", "*.com", "*.scr", "*.tmp", "*.dat") and
not process.executable :
(
"MemCompression",
"Registry",
"vmmem",
"vmmemWSL",
"?:\\Program Files\\Dell\\SupportAssistAgent\\*.p5x",
"?:\\Program Files\\Docker\\Docker\\com.docker.service",
"?:\\Users\\*\\AppData\\Local\\Intel\\AGS\\Libs\\AGSRunner.bin"
) and
not (
(process.name : "C9632CF058AE4321B6B0B5EA39B710FE" and process.code_signature.subject_name == "Dell Inc") or
(process.name : "*.upd" and process.code_signature.subject_name == "Bloomberg LP") or
(process.name: "FD552E21-686E-413C-931D-3B82A9D29F3B" and process.code_signature.subject_name: "Adobe Inc.") or
(process.name: "3B91051C-AE82-43C9-BCEF-0309CD2DD9EB" and process.code_signature.subject_name: "McAfee, LLC")
)
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
rules/windows/execution_downloaded_shortcut_files.toml → rules_building_block/execution_downloaded_shortcut_files.toml
+14 -17
View File
@@ -1,37 +1,34 @@
[metadata]
creation_date = "2020/09/02"
integration = ["endpoint", "windows"]
maturity = "development"
query_schema_validation = false
updated_date = "2023/06/22"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/08/23"
[rule]
author = ["Elastic"]
description = """
Identifies .lnk shortcut file downloaded from outside the local network. These shortcut files are commonly used in
phishing campaigns.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"]
from = "now-119m"
interval = "60m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Downloaded Shortcut Files"
risk_score = 21
rule_id = "6b1fd8e8-cefe-444c-bc4d-feaa2c497347"
rule_id = "39157d52-4035-44a8-9d1a-6f8c5f580a07"
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"]
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend", "Rule Type: BBR"]
timestamp_override = "event.ingested"
type = "eql"
building_block_type = "default"
query = '''
/* leaving in development pending `file.Ext.windows.zone_identifier` landing in ECS then endpoint */
sequence by process.entity_id with maxspan=2s
/* file.extension added to endpoint fields for 7.10 */
[file where host.os.type == "windows" and event.type == "creation" and file.extension == "lnk"]
/* not sure yet how the update will capture ADS */
[file where host.os.type == "windows" and event.type == "creation" and file.extension == "lnk:Zone.Identifier" and
/* non-ECS field - may disqualify conversion */
file.Ext.windows.zone_identifier > 1]
file where host.os.type == "windows" and event.type == "creation" and file.extension == "lnk" and file.Ext.windows.zone_identifier > 1
'''
rules_building_block/execution_mofcomp.toml
+65
View File
@@ -0,0 +1,65 @@
[metadata]
creation_date = "2023/08/23"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/08/23"
[rule]
author = ["Elastic"]
description = """
Managed Object Format (MOF) files can be compiled locally or remotely through mofcomp.exe. Attackers may leverage MOF
files to build their own namespaces and classes into the Windows Management Instrumentation (WMI) repository, or
establish persistence using WMI Event Subscription.
"""
from = "now-119m"
interval = "60m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Mofcomp Activity"
risk_score = 21
rule_id = "210d4430-b371-470e-b879-80b7182aa75e"
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend", "Rule Type: BBR"]
timestamp_override = "event.ingested"
type = "eql"
building_block_type = "default"
query = '''
process where host.os.type == "windows" and event.type == "start" and
process.name : "mofcomp.exe" and process.args : "*.mof" and
not user.id : "S-1-5-18"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"
[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[rule.threat.technique.subtechnique]]
id = "T1546.003"
name = "Windows Management Instrumentation Event Subscription"
reference = "https://attack.mitre.org/techniques/T1546/003/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
rules_building_block/persistence_msoffice_startup_registry.toml
+52
View File
@@ -0,0 +1,52 @@
[metadata]
creation_date = "2023/08/22"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/08/22"
[rule]
author = ["Elastic"]
description = """
Identifies the modification of the Microsoft Office "Office Test" Registry key, a registry location that can be used to
specify a DLL which will be executed every time an MS Office application is started. Attackers can abuse this to gain
persistence on a compromised host.
"""
from = "now-119m"
interval = "60m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Office Test Registry Persistence"
references = [
"https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/",
]
risk_score = 21
rule_id = "14dab405-5dd9-450c-8106-72951af2391f"
severity = "low"
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend", "Rule Type: BBR"]
timestamp_override = "event.ingested"
type = "eql"
building_block_type = "default"
query = '''
registry where host.os.type == "windows" and event.action != "deletion" and
registry.path : "*\\Software\\Microsoft\\Office Test\\Special\\Perf\\*"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1137"
name = "Office Application Startup"
reference = "https://attack.mitre.org/techniques/T1137/"
[[rule.threat.technique.subtechnique]]
id = "T1137.002"
name = "Office Test"
reference = "https://attack.mitre.org/techniques/T1137/002/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"