From ddb1f75352ea19870b5c275b7d152ee2d99cb100 Mon Sep 17 00:00:00 2001 From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com> Date: Tue, 12 Sep 2023 21:49:22 -0300 Subject: [PATCH] [New Rule] New BBR Rules - Part 2 (#3029) * [New Rule] New BBR Rules - Part 2 * Update discovery_generic_account_groups.toml * Update discovery_generic_account_groups.toml * Update rules_building_block/defense_evasion_cmd_copy_binary_contents.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> * Update rules_building_block/execution_downloaded_shortcut_files.toml Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> * Update rules_building_block/defense_evasion_cmd_copy_binary_contents.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update rules_building_block/defense_evasion_unusual_process_extension.toml Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update defense_evasion_unusual_process_extension.toml --------- Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --- .../persistence_registry_uncommon.toml | 9 ++- ...ense_evasion_cmd_copy_binary_contents.toml | 48 ++++++++++++++ ...nse_evasion_unusual_process_extension.toml | 60 +++++++++++++++++ .../execution_downloaded_shortcut_files.toml | 31 ++++----- rules_building_block/execution_mofcomp.toml | 65 +++++++++++++++++++ ...persistence_msoffice_startup_registry.toml | 52 +++++++++++++++ 6 files changed, 247 insertions(+), 18 deletions(-) create mode 100644 rules_building_block/defense_evasion_cmd_copy_binary_contents.toml create mode 100644 rules_building_block/defense_evasion_unusual_process_extension.toml rename {rules/windows => rules_building_block}/execution_downloaded_shortcut_files.toml (59%) create mode 100644 rules_building_block/execution_mofcomp.toml create mode 100644 rules_building_block/persistence_msoffice_startup_registry.toml diff --git a/rules/windows/persistence_registry_uncommon.toml b/rules/windows/persistence_registry_uncommon.toml index 1f981bea1..aaed54042 100644 --- a/rules/windows/persistence_registry_uncommon.toml +++ b/rules/windows/persistence_registry_uncommon.toml @@ -102,7 +102,14 @@ id = "T1547.001" name = "Registry Run Keys / Startup Folder" reference = "https://attack.mitre.org/techniques/T1547/001/" - +[[rule.threat.technique]] +id = "T1546" +name = "Event Triggered Execution" +reference = "https://attack.mitre.org/techniques/T1546/" +[[rule.threat.technique.subtechnique]] +id = "T1546.002" +name = "Screensaver" +reference = "https://attack.mitre.org/techniques/T1546/002/" [rule.threat.tactic] id = "TA0003" diff --git a/rules_building_block/defense_evasion_cmd_copy_binary_contents.toml b/rules_building_block/defense_evasion_cmd_copy_binary_contents.toml new file mode 100644 index 000000000..d7f1350a8 --- /dev/null +++ b/rules_building_block/defense_evasion_cmd_copy_binary_contents.toml @@ -0,0 +1,48 @@ +[metadata] +creation_date = "2023/08/23" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/08/23" + +[rule] +author = ["Elastic"] +description = """ +Attackers may abuse cmd.exe commands to reassemble binary fragments into a malicious payload. +""" +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Binary Content Copy via Cmd.exe" +risk_score = 21 +rule_id = "53dedd83-1be7-430f-8026-363256395c8b" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" +type = "eql" +building_block_type = "default" + +query = ''' +process where host.os.type == "windows" and event.type == "start" and + process.name : "cmd.exe" and ( + (process.args : "type" and process.args : (">", ">>")) or + (process.args : "copy" and process.args : "/b")) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1140" +name = "Deobfuscate/Decode Files or Information" +reference = "https://attack.mitre.org/techniques/T1140/" + + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules_building_block/defense_evasion_unusual_process_extension.toml b/rules_building_block/defense_evasion_unusual_process_extension.toml new file mode 100644 index 000000000..74f784b76 --- /dev/null +++ b/rules_building_block/defense_evasion_unusual_process_extension.toml @@ -0,0 +1,60 @@ +[metadata] +creation_date = "2023/08/23" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/08/23" + +[rule] +author = ["Elastic"] +description = """ +Identifies processes running with unusual extensions that are not typically valid for Windows executables. +""" +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Unusual Process Extension" +risk_score = 21 +rule_id = "800e01be-a7a4-46d0-8de9-69f3c9582b44" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" +type = "eql" +building_block_type = "default" + +query = ''' +process where host.os.type == "windows" and event.type == "start" and + process.executable : "?*" and + not process.name : ("*.exe", "*.com", "*.scr", "*.tmp", "*.dat") and + not process.executable : + ( + "MemCompression", + "Registry", + "vmmem", + "vmmemWSL", + "?:\\Program Files\\Dell\\SupportAssistAgent\\*.p5x", + "?:\\Program Files\\Docker\\Docker\\com.docker.service", + "?:\\Users\\*\\AppData\\Local\\Intel\\AGS\\Libs\\AGSRunner.bin" + ) and + not ( + (process.name : "C9632CF058AE4321B6B0B5EA39B710FE" and process.code_signature.subject_name == "Dell Inc") or + (process.name : "*.upd" and process.code_signature.subject_name == "Bloomberg LP") or + (process.name: "FD552E21-686E-413C-931D-3B82A9D29F3B" and process.code_signature.subject_name: "Adobe Inc.") or + (process.name: "3B91051C-AE82-43C9-BCEF-0309CD2DD9EB" and process.code_signature.subject_name: "McAfee, LLC") + ) +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" diff --git a/rules/windows/execution_downloaded_shortcut_files.toml b/rules_building_block/execution_downloaded_shortcut_files.toml similarity index 59% rename from rules/windows/execution_downloaded_shortcut_files.toml rename to rules_building_block/execution_downloaded_shortcut_files.toml index 87e2411f5..259534f12 100644 --- a/rules/windows/execution_downloaded_shortcut_files.toml +++ b/rules_building_block/execution_downloaded_shortcut_files.toml @@ -1,37 +1,34 @@ [metadata] creation_date = "2020/09/02" -integration = ["endpoint", "windows"] -maturity = "development" -query_schema_validation = false -updated_date = "2023/06/22" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/08/23" [rule] author = ["Elastic"] description = """ Identifies .lnk shortcut file downloaded from outside the local network. These shortcut files are commonly used in phishing campaigns. + """ -from = "now-9m" -index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"] +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] language = "eql" license = "Elastic License v2" name = "Downloaded Shortcut Files" risk_score = 21 -rule_id = "6b1fd8e8-cefe-444c-bc4d-feaa2c497347" +rule_id = "39157d52-4035-44a8-9d1a-6f8c5f580a07" severity = "low" -tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend"] +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" type = "eql" +building_block_type = "default" query = ''' -/* leaving in development pending `file.Ext.windows.zone_identifier` landing in ECS then endpoint */ - -sequence by process.entity_id with maxspan=2s - /* file.extension added to endpoint fields for 7.10 */ - [file where host.os.type == "windows" and event.type == "creation" and file.extension == "lnk"] - /* not sure yet how the update will capture ADS */ - [file where host.os.type == "windows" and event.type == "creation" and file.extension == "lnk:Zone.Identifier" and - /* non-ECS field - may disqualify conversion */ - file.Ext.windows.zone_identifier > 1] +file where host.os.type == "windows" and event.type == "creation" and file.extension == "lnk" and file.Ext.windows.zone_identifier > 1 ''' diff --git a/rules_building_block/execution_mofcomp.toml b/rules_building_block/execution_mofcomp.toml new file mode 100644 index 000000000..7876fc1de --- /dev/null +++ b/rules_building_block/execution_mofcomp.toml @@ -0,0 +1,65 @@ +[metadata] +creation_date = "2023/08/23" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/08/23" + +[rule] +author = ["Elastic"] +description = """ +Managed Object Format (MOF) files can be compiled locally or remotely through mofcomp.exe. Attackers may leverage MOF +files to build their own namespaces and classes into the Windows Management Instrumentation (WMI) repository, or +establish persistence using WMI Event Subscription. +""" +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Mofcomp Activity" +risk_score = 21 +rule_id = "210d4430-b371-470e-b879-80b7182aa75e" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" +type = "eql" +building_block_type = "default" + +query = ''' +process where host.os.type == "windows" and event.type == "start" and + process.name : "mofcomp.exe" and process.args : "*.mof" and + not user.id : "S-1-5-18" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1047" +name = "Windows Management Instrumentation" +reference = "https://attack.mitre.org/techniques/T1047/" + +[rule.threat.tactic] +id = "TA0002" +name = "Execution" +reference = "https://attack.mitre.org/tactics/TA0002/" + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1546" +name = "Event Triggered Execution" +reference = "https://attack.mitre.org/techniques/T1546/" +[[rule.threat.technique.subtechnique]] +id = "T1546.003" +name = "Windows Management Instrumentation Event Subscription" +reference = "https://attack.mitre.org/techniques/T1546/003/" + + + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" diff --git a/rules_building_block/persistence_msoffice_startup_registry.toml b/rules_building_block/persistence_msoffice_startup_registry.toml new file mode 100644 index 000000000..456d3ffdf --- /dev/null +++ b/rules_building_block/persistence_msoffice_startup_registry.toml @@ -0,0 +1,52 @@ +[metadata] +creation_date = "2023/08/22" +integration = ["endpoint"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/08/22" + +[rule] +author = ["Elastic"] +description = """ +Identifies the modification of the Microsoft Office "Office Test" Registry key, a registry location that can be used to +specify a DLL which will be executed every time an MS Office application is started. Attackers can abuse this to gain +persistence on a compromised host. +""" +from = "now-119m" +interval = "60m" +index = ["logs-endpoint.events.*"] +language = "eql" +license = "Elastic License v2" +name = "Office Test Registry Persistence" +references = [ + "https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/", +] +risk_score = 21 +rule_id = "14dab405-5dd9-450c-8106-72951af2391f" +severity = "low" +tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend", "Rule Type: BBR"] +timestamp_override = "event.ingested" +type = "eql" +building_block_type = "default" + +query = ''' +registry where host.os.type == "windows" and event.action != "deletion" and + registry.path : "*\\Software\\Microsoft\\Office Test\\Special\\Perf\\*" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1137" +name = "Office Application Startup" +reference = "https://attack.mitre.org/techniques/T1137/" +[[rule.threat.technique.subtechnique]] +id = "T1137.002" +name = "Office Test" +reference = "https://attack.mitre.org/techniques/T1137/002/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/"