-
Notifications
You must be signed in to change notification settings - Fork 25
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Sigma Rule Update (2023-11-20 20:08:06) (#536)
Co-authored-by: hach1yon <[email protected]>
- Loading branch information
1 parent
3bffc96
commit 273462e
Showing
14 changed files
with
431 additions
and
102 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
79 changes: 79 additions & 0 deletions
79
sigma/builtin/process_creation/proc_creation_win_susp_eventlog_content_recon.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| title: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities | ||
| id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf | ||
| related: | ||
| - id: 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f | ||
| type: derived | ||
| status: experimental | ||
| description: 'Detects execution of different log query utilities to search and dump | ||
| the content of specific event logs or look for specific event IDs. | ||
| ' | ||
| references: | ||
| - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html | ||
| - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ | ||
| - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a | ||
| - https://www.group-ib.com/blog/apt41-world-tour-2021/ | ||
| - https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf | ||
| - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3 | ||
| - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1 | ||
| - http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/ | ||
| - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil | ||
| author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) | ||
| date: 2022/09/09 | ||
| modified: 2023/11/20 | ||
| tags: | ||
| - attack.credential_access | ||
| - attack.discovery | ||
| - attack.t1552 | ||
| logsource: | ||
| category: process_creation | ||
| product: windows | ||
| detection: | ||
| process_creation: | ||
| EventID: 4688 | ||
| Channel: Security | ||
| selection_wmi: | ||
| CommandLine|contains|all: | ||
| - Select | ||
| - Win32_NTLogEvent | ||
| selection_wevtutil_img: | ||
| - NewProcessName|endswith: \wevtutil.exe | ||
| - OriginalFileName: wevtutil.exe | ||
| selection_wevtutil_cli: | ||
| CommandLine|contains: | ||
| - ' qe ' | ||
| - ' query-events ' | ||
| selection_wmic_img: | ||
| - NewProcessName|endswith: \wevtutil.exe | ||
| - OriginalFileName: wevtutil.exe | ||
| selection_wmic_cli: | ||
| CommandLine|contains: ' ntevent' | ||
| selection_cmdlet: | ||
| CommandLine|contains: | ||
| - 'Get-WinEvent ' | ||
| - 'get-eventlog ' | ||
| selection_logs_name: | ||
| CommandLine|contains: | ||
| - Microsoft-Windows-TerminalServices-LocalSessionManager/Operational | ||
| - Microsoft-Windows-Terminal-Services-RemoteConnectionManager/Operational | ||
| - Security | ||
| selection_logs_eid: | ||
| CommandLine|contains: | ||
| - -InstanceId 4624 | ||
| - System[EventID=4624] | ||
| - EventCode=?4624? | ||
| - EventIdentifier=?4624? | ||
| - -InstanceId 4778 | ||
| - System[EventID=4778] | ||
| - EventCode=?4778? | ||
| - EventIdentifier=?4778? | ||
| - -InstanceId 25 | ||
| - System[EventID=25] | ||
| - EventCode=?25? | ||
| - EventIdentifier=?25? | ||
| condition: process_creation and (1 of selection_logs_* and (selection_wmi or all | ||
| of selection_wevtutil_* or all of selection_wmic_* or selection_cmdlet)) | ||
| falsepositives: | ||
| - Legitimate usage of the utility by administrators to query the event log | ||
| level: medium | ||
| ruletype: Sigma |
33 changes: 0 additions & 33 deletions
33
sigma/builtin/process_creation/proc_creation_win_wevtutil_recon.yml
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
55 changes: 55 additions & 0 deletions
55
sigma/builtin/threat-hunting/process_creation/proc_creation_win_susp_event_log_query.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| title: EventLog Query Requests By Builtin Utilities | ||
| id: 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f | ||
| related: | ||
| - id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf | ||
| type: derived | ||
| status: experimental | ||
| description: 'Detect attempts to query the contents of the event log using command | ||
| line utilities. Attackers use this technique in order to look for sensitive information | ||
| in the logs such as passwords, usernames, IPs, etc. | ||
| ' | ||
| references: | ||
| - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3 | ||
| - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1 | ||
| - http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/ | ||
| - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil | ||
| author: Ali Alwashali, Nasreddine Bencherchali (Nextron Systems) | ||
| date: 2023/11/20 | ||
| tags: | ||
| - attack.t1552 | ||
| - attack.credential_access | ||
| - detection.threat_hunting | ||
| logsource: | ||
| product: windows | ||
| category: process_creation | ||
| detection: | ||
| process_creation: | ||
| EventID: 4688 | ||
| Channel: Security | ||
| selection_wmi: | ||
| CommandLine|contains|all: | ||
| - Select | ||
| - Win32_NTLogEvent | ||
| selection_wevtutil_img: | ||
| - NewProcessName|endswith: \wevtutil.exe | ||
| - OriginalFileName: wevtutil.exe | ||
| selection_wevtutil_cli: | ||
| CommandLine|contains: | ||
| - ' qe ' | ||
| - ' query-events ' | ||
| selection_wmic_img: | ||
| - NewProcessName|endswith: \wevtutil.exe | ||
| - OriginalFileName: wevtutil.exe | ||
| selection_wmic_cli: | ||
| CommandLine|contains: ' ntevent' | ||
| selection_cmdlet: | ||
| CommandLine|contains: | ||
| - 'Get-WinEvent ' | ||
| - 'get-eventlog ' | ||
| condition: process_creation and (selection_wmi or all of selection_wevtutil_* | ||
| or all of selection_wmic_* or selection_cmdlet) | ||
| falsepositives: | ||
| - Legitimate log access by administrators or troubleshooting tools | ||
| level: medium | ||
| ruletype: Sigma |
39 changes: 39 additions & 0 deletions
39
sigma/sysmon/dns_query/dns_query_win_devtunnels_communication.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| title: DNS Query To Devtunnels Domain | ||
| id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b | ||
| related: | ||
| - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 | ||
| type: similar | ||
| - id: 4b657234-038e-4ad5-997c-4be42340bce4 | ||
| type: similar | ||
| - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 | ||
| type: similar | ||
| status: experimental | ||
| description: 'Detects DNS query requests to Devtunnels domains. Attackers can abuse | ||
| that feature to establish a reverse shell or persistence on a machine. | ||
| ' | ||
| references: | ||
| - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2 | ||
| - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security | ||
| - https://cydefops.com/devtunnels-unleashed | ||
| author: citron_ninja | ||
| date: 2023/10/25 | ||
| modified: 2023/11/20 | ||
| tags: | ||
| - attack.command_and_control | ||
| - attack.t1071.001 | ||
| - sysmon | ||
| logsource: | ||
| category: dns_query | ||
| product: windows | ||
| detection: | ||
| dns_query: | ||
| EventID: 22 | ||
| Channel: Microsoft-Windows-Sysmon/Operational | ||
| selection: | ||
| QueryName|endswith: .devtunnels.ms | ||
| condition: dns_query and selection | ||
| falsepositives: | ||
| - Legitimate use of Devtunnels will also trigger this. | ||
| level: medium | ||
| ruletype: Sigma |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
40 changes: 40 additions & 0 deletions
40
sigma/sysmon/network_connection/net_connection_win_devtunnel_connection.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| title: Network Connection Initiated To DevTunnels Domain | ||
| id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 | ||
| related: | ||
| - id: 4b657234-038e-4ad5-997c-4be42340bce4 | ||
| type: similar | ||
| - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 | ||
| type: similar | ||
| - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b | ||
| type: similar | ||
| status: experimental | ||
| description: 'Detects network connections to Devtunnels domains initiated by a process | ||
| on a system. Attackers can abuse that feature to establish a reverse shell or | ||
| persistence on a machine. | ||
| ' | ||
| references: | ||
| - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2 | ||
| - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security | ||
| - https://cydefops.com/devtunnels-unleashed | ||
| author: Kamran Saifullah | ||
| date: 2023/11/20 | ||
| tags: | ||
| - attack.exfiltration | ||
| - attack.t1567.001 | ||
| - sysmon | ||
| logsource: | ||
| category: network_connection | ||
| product: windows | ||
| detection: | ||
| network_connection: | ||
| EventID: 3 | ||
| Channel: Microsoft-Windows-Sysmon/Operational | ||
| selection: | ||
| Initiated: 'true' | ||
| DestinationHostname|endswith: .devtunnels.ms | ||
| condition: network_connection and selection | ||
| falsepositives: | ||
| - Legitimate use of Devtunnels will also trigger this. | ||
| level: medium | ||
| ruletype: Sigma |
40 changes: 40 additions & 0 deletions
40
sigma/sysmon/network_connection/net_connection_win_vscode_tunnel_connection.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| title: Network Connection Initiated To Visual Studio Code Tunnels Domain | ||
| id: 4b657234-038e-4ad5-997c-4be42340bce4 | ||
| related: | ||
| - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 | ||
| type: similar | ||
| - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 | ||
| type: similar | ||
| - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b | ||
| type: similar | ||
| status: experimental | ||
| description: 'Detects network connections to Visual Studio Code tunnel domains initiated | ||
| by a process on a system. Attackers can abuse that feature to establish a reverse | ||
| shell or persistence on a machine. | ||
| ' | ||
| references: | ||
| - https://ipfyx.fr/post/visual-studio-code-tunnel/ | ||
| - https://badoption.eu/blog/2023/01/31/code_c2.html | ||
| - https://cydefops.com/vscode-data-exfiltration | ||
| author: Kamran Saifullah | ||
| date: 2023/11/20 | ||
| tags: | ||
| - attack.exfiltration | ||
| - attack.t1567.001 | ||
| - sysmon | ||
| logsource: | ||
| category: network_connection | ||
| product: windows | ||
| detection: | ||
| network_connection: | ||
| EventID: 3 | ||
| Channel: Microsoft-Windows-Sysmon/Operational | ||
| selection: | ||
| Initiated: 'true' | ||
| DestinationHostname|endswith: .tunnels.api.visualstudio.com | ||
| condition: network_connection and selection | ||
| falsepositives: | ||
| - Legitimate use of Visual Studio Code tunnel will also trigger this. | ||
| level: medium | ||
| ruletype: Sigma |
Oops, something went wrong.