shashank-elastic
66 lines
2.0 KiB
TOML
66 lines
2.0 KiB
TOML
[metadata]
|
|
creation_date = "2023/07/12"
|
|
integration = ["endpoint"]
|
|
maturity = "production"
|
|
updated_date = "2024/05/21"
|
|
|
|
[rule]
|
|
author = ["Elastic"]
|
|
building_block_type = "default"
|
|
description = """
|
|
Identifies the change of permissions/ownership of files/folders through built-in Windows utilities. Threat actors may
|
|
require permission modification of files/folders to change, modify or delete them.
|
|
"""
|
|
from = "now-119m"
|
|
index = ["logs-endpoint.events.process-*"]
|
|
interval = "60m"
|
|
language = "eql"
|
|
license = "Elastic License v2"
|
|
name = "File and Directory Permissions Modification"
|
|
risk_score = 21
|
|
rule_id = "bc9e4f5a-e263-4213-a2ac-1edf9b417ada"
|
|
severity = "low"
|
|
tags = [
|
|
"Domain: Endpoint",
|
|
"OS: Windows",
|
|
"Use Case: Threat Detection",
|
|
"Tactic: Defense Evasion",
|
|
"Rule Type: BBR",
|
|
"Data Source: Elastic Defend",
|
|
]
|
|
timestamp_override = "event.ingested"
|
|
type = "eql"
|
|
|
|
query = '''
|
|
process where event.type == "start" and host.os.type == "windows" and
|
|
(
|
|
((process.name: "icacls.exe" or process.pe.original_file_name == "iCACLS.EXE") and process.args: ("*:F", "/reset", "/setowner", "*grant*")) or
|
|
((process.name: "cacls.exe" or process.pe.original_file_name == "CACLS.EXE") and process.args: ("/g", "*:f")) or
|
|
((process.name: "takeown.exe" or process.pe.original_file_name == "takeown.exe") and process.args: ("/F")) or
|
|
((process.name: "attrib.exe" or process.pe.original_file_name== "ATTRIB.EXE") and process.args: "-r")
|
|
) and not user.id : "S-1-5-18" and
|
|
not (
|
|
process.args : ("C:\\ProgramData\\Lenovo\\*", "C:\\ProgramData\\Adobe\\*", "C:\\ProgramData\\ASUS\\ASUS*")
|
|
)
|
|
'''
|
|
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[rule.threat.technique]]
|
|
id = "T1222"
|
|
name = "File and Directory Permissions Modification"
|
|
reference = "https://attack.mitre.org/techniques/T1222/"
|
|
[[rule.threat.technique.subtechnique]]
|
|
id = "T1222.001"
|
|
name = "Windows File and Directory Permissions Modification"
|
|
reference = "https://attack.mitre.org/techniques/T1222/001/"
|
|
|
|
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0005"
|
|
name = "Defense Evasion"
|
|
reference = "https://attack.mitre.org/tactics/TA0005/"
|
|
|