security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
517 Commits 1 Branch 0 Tags
497ddcbb5898487d0a9f8b8bfcd606dad2e1edf9
Commit Graph

74 Commits

Author SHA1 Message Date
Samirbous 142a26a010 [New Rule] Suspicious Adobe Acrobat Updates Service Child Process (#886) 
* [New Rule] Suspicious Adobe Acrobat Updates Service Child Process

* Update rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

* Update rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2021-02-10 14:08:37 +01:00
Samirbous 58f0bf5998 [Rule Tuning] Attempt to Remove File Quarantine Attribute (#781) 
* [Rule Tuning] Attempt to Remove File Quarantine Attribute

* Update defense_evasion_attempt_del_quarantine_attrib.toml

* adjusted query coverage

* Update rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* date

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-10 10:45:50 +01:00
Samirbous 51498f6022 [New Rule] Attempt to Mount an SMB Share via Command-line (#914) 
* [New Rule] Attempt to Mount an SMB Share via Command-line

* fixed tactic_id

* 2021!

* Update lateral_movement_mounting_smb_share.toml

* Update rules/macos/lateral_movement_mounting_smb_share.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/lateral_movement_mounting_smb_share.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/lateral_movement_mounting_smb_share.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* lint rule

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
 2021-02-09 22:08:30 +01:00
Samirbous a50a65a4d7 [Rule Tuning] Execution with Explicit Credentials via Scripting (#910) 2021-02-09 22:06:23 +01:00
Samirbous 7d4bd35bf0 [New Rule] Potential Privileges Escalation via Root Crontab File Modi… (#919) 
* [New Rule] Potential Privileges Escalation via Root Crontab File Modification

* Update privilege_escalation_root_crontab_filemod.toml

* Update rules/macos/privilege_escalation_root_crontab_filemod.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/privilege_escalation_root_crontab_filemod.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* lint rule

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
 2021-02-09 22:04:14 +01:00
Samirbous 424a182383 [New Rule] Dumping Accounts Hashes using Built-In Commands (#908) 
* [New Rule] Dumping Accounts Hashes using Built-In Commands

* fixed dates

* Update credential_access_dumping_hashes_bi_cmds.toml

* Update rules/macos/credential_access_dumping_hashes_bi_cmds.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/credential_access_dumping_hashes_bi_cmds.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/credential_access_dumping_hashes_bi_cmds.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/credential_access_dumping_hashes_bi_cmds.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-09 21:49:51 +01:00
Samirbous 68f834270d [New Rule] Potential Persistence via Atom Init Script Modification (#906) 
* [New Rule] Potential Persistence via Atom Init Script Modification

* Update rules/macos/persistence_via_atom_init_file_modification.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/persistence_via_atom_init_file_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-09 21:47:08 +01:00
Samirbous 5ae9347663 [New Rule] Suspicious Calendar File Modification (#880) 
* [New Rule] Suspicious Calendar File Modification

* description

* index

* excluding FPs by path

* Update persistence_suspicious_calendar_modification.toml

* Update persistence_suspicious_calendar_modification.toml

* Update rules/macos/persistence_suspicious_calendar_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_suspicious_calendar_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-09 21:44:45 +01:00
Samirbous aa2dcd58e7 [New Rule] Persistence via DirectoryService Plugin Modification (#858) 
* [New Rule] Persistence via DirectoryService Plugin Modification

* Update persistence_directory_services_plugins_modification.toml

* adjusted description

* Update rules/macos/persistence_directory_services_plugins_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_directory_services_plugins_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_directory_services_plugins_modification.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* relinted

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
 2021-02-09 10:59:35 +01:00
Samirbous cfd42babd1 [New Rule] Enumeration of Users or Groups using Built-In Commands (#848) 
* [New Rule] Enumeration of Users or Groups using Built-In Commands

* Update discovery_users_domain_built_in_commands.toml

* added search option

* excluded some noisy processes

* Update discovery_users_domain_built_in_commands.toml

* Update rules/macos/discovery_users_domain_built_in_commands.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/discovery_users_domain_built_in_commands.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/discovery_users_domain_built_in_commands.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/discovery_users_domain_built_in_commands.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/discovery_users_domain_built_in_commands.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/discovery_users_domain_built_in_commands.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2021-02-09 10:50:39 +01:00
David French e507898dbd [New Rule] Attempt to Disable Gatekeeper (#841) 2021-02-08 20:25:04 -07:00
Samirbous 519078c87c [New Rule] Authorization Plugin Modification (#856) 
* [New Rule] Authorization Plugin Modification

* Update credential_access_persistence_authorization_plugin_creation.toml

* Update rules/macos/credential_access_persistence_authorization_plugin_creation.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/credential_access_persistence_authorization_plugin_creation.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* tactic

* filename

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 23:14:25 +01:00
Samirbous 2092c70f11 [New Rule] Finder Sync Plugin Enabled (#735) 
* [New Rule] Finder Sync Plugin Enabled

* ref url decoded

* Update rules/macos/persistence_finder_sync_plugin_pluginkit.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_finder_sync_plugin_pluginkit.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* excluded some common finder plugins

* Update rules/macos/persistence_finder_sync_plugin_pluginkit.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_finder_sync_plugin_pluginkit.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 23:08:49 +01:00
Samirbous fb32679921 [New Rule] Access to SystemKey via Hexdump (#815) 
* [New Rule] Access to SystemKey via Hexdump

* Update rules/macos/credential_access_systemkey_dumping.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/credential_access_systemkey_dumping.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/credential_access_systemkey_dumping.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update credential_access_systemkey_dumping.toml

* relinted

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 23:02:02 +01:00
Samirbous 6e2d8830e1 [New Rule] Attempt to Install Root Certificate (#850) 
* [New Rule]  Attempt to Install Root Certificate

* Update rules/macos/defense_evasion_install_root_certificate.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_install_root_certificate.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 22:49:35 +01:00
Samirbous a08adbf10c [New Rule] Suspicious Launchd Hidden Child Process (#823) 
* [New Rule] Hidden Launcd Child Process

* adjusted name and added extra ref

* severity change

* Update rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* added subtechnique

* Update rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2021-02-08 22:43:21 +01:00
Samirbous 53db78fccc [New Rule] Lateral Movement via Kerberos using Bifrost Console (#843) 
* [New Rule] Lateral Movement via Kerberos using Bifrost Console

* adjusted kql for perf

* mitre techniques order

* added two args

* Update lateral_movement_credential_access_kerberos_bifrostconsole.toml

* Update rules/macos/lateral_movement_credential_access_kerberos_bifrostconsole.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/lateral_movement_credential_access_kerberos_bifrostconsole.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/lateral_movement_credential_access_kerberos_bifrostconsole.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/lateral_movement_credential_access_kerberos_bifrostconsole.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 22:34:54 +01:00
Samirbous 429a975d14 [New Rule] Keychain Password Retrieval via Commandline (#811) 
* [New Rule] Keychain Password Retrieval via Commandline

* added false positives note

* added internet-pwd option

* extra refurl

* Update rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

* fixed technique

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 22:31:16 +01:00
Samirbous 18a4e468ce [New Rule] Attempt to Unload Elastic Endpoint Security Kernel Extension (#807) 
* [New Rule] Attempt to Unload Elastic Endpoint Security Kernel Extension

* Update rules/macos/defense_evasion_unload_endpointsecurity_kext.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_unload_endpointsecurity_kext.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_unload_endpointsecurity_kext.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* added subtechnique

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 22:22:16 +01:00
Brent Murphy 64366218c7 adjust risk score (#938) 2021-02-08 13:15:42 -05:00
Samirbous 6ca381763d [New Rule] Execution with Administrator Privileges via Apple Scripting (#777) 
* [New Rule] Execution with Administrator Privileges via Apple Scripting

* Update privilege_escalation_applescript_with_admin_privs.toml

* Update rules/macos/privilege_escalation_applescript_with_admin_privs.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/privilege_escalation_applescript_with_admin_privs.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/privilege_escalation_applescript_with_admin_privs.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/privilege_escalation_applescript_with_admin_privs.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
 2021-02-08 17:39:22 +01:00
Samirbous ef01430ab0 [Rule Tuning] Compression of Keychain Credentials Directories (#787) 
* [Rule Tuning] Access to Keychain Credentials Directories

* linted

* renmaed rule filename

* added keychain filenames 

added filenames in case of exec from keychain working directory

* extra reference

* Update rules/macos/credential_access_credentials_keychains.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update credential_access_credentials_keychains.toml

* 2021

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Brent Murphy <bmurphy@endgame.com>
 2021-02-08 17:31:04 +01:00
Samirbous 79b0a940c5 [New Rule] Attempt to Create a Hidden Local Account (#799) 
* [New Rule] Attempt to Create a Hidden Local Account

* adjusted query for perfmc

* Update persistence_account_creation_hide_at_logon.toml

* Update persistence_account_creation_hide_at_logon.toml

* Update rules/macos/persistence_account_creation_hide_at_logon.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_account_creation_hide_at_logon.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 17:24:56 +01:00
Samirbous 55998ff02a [New Rule] Creation Attempt of a Hidden Login Item via Apple Script (#801) 
* [New Rule] Creation Attempt of a Hidden Login Item via Apple Script

* fixed TID

* Update persistence_creation_hidden_login_item_osascript.toml

* Update rules/macos/persistence_creation_hidden_login_item_osascript.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_creation_hidden_login_item_osascript.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_creation_hidden_login_item_osascript.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_creation_hidden_login_item_osascript.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_creation_hidden_login_item_osascript.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 17:22:01 +01:00
Samirbous b9a6452001 [New Rule] Attempt to Enable the Root Account (#792) 
* [New Rule] Attempt to Enable the Root Account

* Update rules/macos/persistence_enable_root_account.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 17:10:43 +01:00
Samirbous b73564b541 [Rule Tuning] Remote SSH Login Enabled via systemsetup Command (#783) 2021-02-08 16:54:39 +01:00
Samirbous 055c8ec4f7 [New Rule] Potential MacOS Privacy Controls Bypass via TCCDB Modification (#765) 
* [New Rule] Potential MacOS Privacy Controls Bypass

* added extra ref and arg if exec from TCC current directory

* Update defense_evasion_privacy_controls_tcc_database_modification.toml

* renamed

* Update defense_evasion_privacy_controls_tcc_database_modification.toml

* adjusted to catch rogue TCCDB PrivEsc Exploit

* Update defense_evasion_privacy_controls_tcc_database_modification.toml

* Update defense_evasion_privacy_controls_tcc_database_modification.toml

* Update rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* added subtechnique

* relinted

* Update rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
 2021-02-08 16:48:53 +01:00
Samirbous 8b8cbcf8dd [Rule Tuning] Prompt for Credentials with OSASCRIPT (#759) 
* [Rule Tuning] Prompt for Credentials with OSASCRIPT

* Update credential_access_promt_for_pwd_via_osascript.toml

* Update credential_access_promt_for_pwd_via_osascript.toml

* Update rules/macos/credential_access_promt_for_pwd_via_osascript.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* update date

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 16:42:23 +01:00
Samirbous 4cb28adece [New Rule] Sublime Plugin or Application Script Modification (#761) 
* [New Rule] Sublime Plugin or Application Script Modification

* excluded some noisy procs

* Update rules/macos/persistence_modification_sublime_app_plugin_or_script.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_modification_sublime_app_plugin_or_script.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_modification_sublime_app_plugin_or_script.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* added T1554

* fixed tactic

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 16:34:44 +01:00
Samirbous 6a61caa84f [New Rule] Suspicious Browser Child Process (#767) 
* [New Rule] Suspicious Browser Child Process

* auditbeat removed

auditbeat process execution does not log the parent process name.

* added more suspicious childproc

* added perl and php

* Update execution_initial_access_suspicious_browser_childproc.toml

* Update execution_initial_access_suspicious_browser_childproc.toml

* Update execution_initial_access_suspicious_browser_childproc.toml

* excluded noisy stuff

* Update rules/macos/execution_initial_access_suspicious_browser_childproc.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/execution_initial_access_suspicious_browser_childproc.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/execution_initial_access_suspicious_browser_childproc.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-08 15:06:18 +01:00
Samirbous 4900c9a018 [New Rule] Potential Office Sandbox Evasion via ZIP File (#834) 
* [New Rule] Potential Office Sandbox Evasion via LaunchAgent ZIP File

* adjusted query to account for other autostart paths

* adjusted query and description

* Update defense_evasion_sandboxed_office_app_suspicious_zip_file.toml

* Update rules/macos/defense_evasion_sandboxed_office_app_suspicious_zip_file.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_sandboxed_office_app_suspicious_zip_file.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

* 2021!

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-04 16:47:58 +01:00
Samirbous a8931a927c [New Rule] Safari Settings Modification using Defaults Command (#861) 
* [New Rule] Safari Settings Modification using Defaults Command

* exclude some unsensitive changes

* Update rules/macos/defense_evasion_safari_config_change.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_safari_config_change.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_safari_config_change.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_safari_config_change.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/defense_evasion_safari_config_change.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

* added subtechnique

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>
 2021-02-04 16:38:56 +01:00
Samirbous 6e59996fd0 [New Rule] Access to Browsers Credential Files (#789) 
* [New Rule] Access to Browsers Credential Files

* removed Thunderbird from list

out of browsers context, may go into a different rule with other mail clients

* adjusted Safari cookies path

to include for folder access, file access is covered by Cookies.binarycookies check

* excluded a noisy arg

* Update credential_access_access_to_browser_credentials_procargs.toml

* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

* Update rules/macos/credential_access_access_to_browser_credentials_procargs.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-04 16:34:49 +01:00
Samirbous 37ccdad0ee [New Rule] Virtual Private Network Connection Attempt (#912) 
* [New Rule] Virtual Private Network Connection Attempt

* fixed tactic_id

* Update lateral_movement_vpn_connection_attempt.toml

* Update rules/macos/lateral_movement_vpn_connection_attempt.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-03 18:18:09 +01:00
Samirbous 8878104f54 [New Rule] Potential Persistence via Periodic Tasks (#898) 
* [New Rule] Potential Persistence via Periodic Tasks

* Update rules/macos/persistence_periodic_tasks_file_mdofiy.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/persistence_periodic_tasks_file_mdofiy.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/persistence_periodic_tasks_file_mdofiy.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/persistence_periodic_tasks_file_mdofiy.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/persistence_periodic_tasks_file_mdofiy.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/persistence_periodic_tasks_file_mdofiy.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_periodic_tasks_file_mdofiy.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-03 18:15:25 +01:00
Samirbous d733971e99 [New Rule] SoftwareUpdate Preferences Modification (#869) 
* [New Rule] SoftwareUpdate Preferences Modification

* Update defense_evasion_apple_softupdates_modification.toml

* Update rules/macos/defense_evasion_apple_softupdates_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_apple_softupdates_modification.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

* added subtechnique

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-03 18:12:37 +01:00
Samirbous b1a8292462 [New Rule] Potential Privacy Controls Bypass via Localhost Secure Copy (#830) 
* [New Rule] Potential Privacy Controls Bypass via Localhost Secure Copy

* rename rule

* exclude FPs

* Update defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml

* Update rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-02-03 17:54:15 +01:00
Samirbous 326bebdebe [New Rule] Execution via Electron Child Process Node.js Module (#817) 
* [New Rule] Execution via Electron ChildProc Node.js Module

* relinted

* fixed TID and adjusted KQL for perf

* fixed kql

* Update rules/macos/execution_defense_evasion_electron_app_childproc_node_js.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/execution_defense_evasion_electron_app_childproc_node_js.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
 2021-01-29 19:06:49 +01:00
Samirbous ad514eaeab [New Rule] Attempt to Add an Account to the Admin Group (#803) 
* [New Rule] Attempt to Add an Account to the Admin Group

* adjusted query for perf

* Update rules/macos/privilege_escalation_local_user_added_to_admin.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/privilege_escalation_local_user_added_to_admin.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/privilege_escalation_local_user_added_to_admin.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
 2021-01-29 19:03:17 +01:00
Samirbous cd3f72cf15 [New Rule] Creation of a Hidden Launch Agent or Daemon (#797) 
* [New Rule] Creation of a Hidden Launch Agent or Daemon

* updated TID

* Update persistence_evasion_hidden_launch_agent_deamon_creation.toml

* Update persistence_evasion_hidden_launch_agent_deamon_creation.toml

* Update rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* sub-technique stuff

* relint

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-01-29 19:01:15 +01:00
Samirbous a5ded6513c [New Rule] Browser Hijack via Setting the Web Proxy to Localhost (#805) 
* [New Rule] Browser Hijack via Setting the Web Proxy to Localhost

* fixed dates

* adjusted query to include traffic redirection

* relinted

* added extra arg

* reduced severity

* Update rules/macos/credential_access_mitm_localhost_webproxy.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/credential_access_mitm_localhost_webproxy.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/credential_access_mitm_localhost_webproxy.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/credential_access_mitm_localhost_webproxy.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-01-29 18:58:14 +01:00
Samirbous acff6a3a5d [New Rule] 2 Rules for Persistence via Emond (#832) 
* [New Rule] 2 Rules for Persistence via Emond

* removed auditbeat index

process.parent.name not captured

* Update persistence_emond_rules_process_execution.toml

* Update rules/macos/persistence_emond_rules_file_creation.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_emond_rules_process_execution.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_emond_rules_file_creation.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/persistence_emond_rules_process_execution.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relint

* 2021

* Update persistence_emond_rules_process_execution.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-01-29 09:16:27 +01:00
brokensound77 ec4c9e77a2 Update revoked technique 2021-01-28 11:03:17 -09:00
brokensound77 bf32dec5a4 Merge remote-tracking branch 'upstream/main' into mergeback/7.11-to-main 
# Conflicts:
#	rules/linux/defense_evasion_deletion_of_bash_command_line_history.toml
 2021-01-28 10:41:39 -09:00
Samirbous 1d77932434 [New Rule] Suspicious MacOS MS Office Child Process (#779) 
* [New Rule] Suspicious MacOS MS Office Child Process

* extra bin and ref

* Update execution_suspicious_mac_ms_office_child_process.toml

* Update rules/macos/execution_suspicious_mac_ms_office_child_process.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Update rules/macos/execution_suspicious_mac_ms_office_child_process.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/execution_suspicious_mac_ms_office_child_process.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-01-28 19:55:31 +01:00
Samirbous c18c5a493a [New Rule] Dumping of Keychain Content via Security Command (#785) 
* [New Rule] Dumping of Keychain Content via Security Command

* converted to eql

* added sub-technique

* 2021

* Update rules/macos/credential_access_dumping_keychain_security.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* relinted

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
 2021-01-28 19:50:41 +01:00
Samirbous 485c6214fa [New Rule] Environment Variable Modification using Launchctl (#865) 
* [New Rule] Environment Variable Modification using Launchctl

* excluding some FPs

* Update defense_evasion_modify_environment_launchctl.toml

* Update defense_evasion_modify_environment_launchctl.toml

* Update rules/macos/defense_evasion_modify_environment_launchctl.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_modify_environment_launchctl.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>

* Update rules/macos/defense_evasion_modify_environment_launchctl.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

* Update rules/macos/defense_evasion_modify_environment_launchctl.toml

Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Andrew Pease <7442091+peasead@users.noreply.github.com>
 2021-01-26 21:41:30 +01:00
Samirbous b4cb953aa4 [New Rule] Script Execution via Automator Workflows (#763) 
* [New Rule] Script Execution via Automator Workflows

* Update execution_script_via_automator_workflows.toml

* Update rules/macos/execution_script_via_automator_workflows.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

* Update rules/macos/execution_script_via_automator_workflows.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
 2021-01-26 09:07:39 +01:00
Samirbous 5d9c031c8b [New Rule] TCC Bypass via Mounted APFS Snapshot Access (#775) 
* [New Rule] TCC Bypass via Mounted APFS Snapshot Access

* Update defense_evasion_tcc_bypass_mounted_apfs_access.toml

* conv to kql

* Update rules/macos/defense_evasion_tcc_bypass_mounted_apfs_access.toml

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>

Co-authored-by: David French <56409778+threat-punter@users.noreply.github.com>
 2021-01-26 08:50:28 +01:00
Samirbous dc53fc1f04 [New Rule] Persistence via Docker Shortcut Modification (#733) 
* [New Rule] Persistence via Docker Shortcut Modification

* ref url decoded

* added exclusions

* Update rules/macos/persistence_docker_shortcuts_plist_modification.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_docker_shortcuts_plist_modification.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* exclude some noisy procs and conv to kql

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
 2021-01-26 08:38:38 +01:00