Antivirus Exploitation Framework Detection

title: Antivirus Exploitation Framework Detection
id: 238527ad-3c2c-4e4f-a1f6-92fd63adb864
status: test
description: Detects a highly relevant Antivirus alert that reports an exploitation framework
author: Florian Roth
references:
- https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/
date: 2018/09/09
modified: 2021/11/27
logsource:
product: antivirus
detection:
selection:
Signature|contains:
- 'MeteTool'
- 'MPreter'
- 'Meterpreter'
- 'Metasploit'
- 'PowerSploit'
- 'CobaltStrike'
- 'Swrort'
- 'Rozena'
- 'Backdoor.Cobalt'
- 'CobaltStr'
- 'COBEACON'
- 'Cometer'
- 'Razy'
condition: selection
fields:
- FileName
- User
falsepositives:
- Unlikely
level: critical
tags:
- attack.execution
- attack.t1203
- attack.command_and_control
- attack.t1219

Antivirus Hacktool Detection

title: Antivirus Hacktool Detection
id: fa0c05b6-8ad3-468d-8231-c1cbccb64fba
description: Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool
status: experimental
date: 2021/08/16
author: Florian Roth
references:
    - https://www.nextron-systems.com/2021/08/16/antivirus-event-analysis-cheat-sheet-v1-8-2/
logsource:
    product: antivirus
detection:
    selection:
        - Signature|startswith:
            - 'HTOOL'
            - 'HKTL'
            - 'SecurityTool'
            - 'ATK/'  # Sophos
        - Signature|contains:
            - 'Hacktool'
    condition: selection
fields:
    - FileName
    - User
falsepositives:
    - Unlikely
level: high
tags:
    - attack.execution
    - attack.t1204

Antivirus Password Dumper Detection

title: Antivirus Password Dumper Detection
id: 78cc2dd2-7d20-4d32-93ff-057084c38b93
status: test
description: Detects a highly relevant Antivirus alert that reports a password dumper
author: Florian Roth
references:
  - https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/
  - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619/detection
date: 2018/09/09
modified: 2021/11/27
logsource:
  product: antivirus
detection:
  selection:
    Signature|contains:
      - 'DumpCreds'
      - 'Mimikatz'
      - 'PWCrack'
      - 'HTool/WCE'
      - 'PSWtool'
      - 'PWDump'
      - 'SecurityTool'
      - 'PShlSpy'
      - 'Rubeus'
      - 'Kekeo'
      - 'LsassDump'
      - 'Outflank'
  condition: selection
fields:
  - FileName
  - User
falsepositives:
  - Unlikely
level: critical
tags:
  - attack.credential_access
  - attack.t1003
  - attack.t1558
  - attack.t1003.001
  - attack.t1003.002

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

title: Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection
id: 6fe1719e-ecdf-4caf-bffe-4f501cb0a561
status: stable
description: Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .
references:
    - https://twitter.com/mvelazco/status/1410291741241102338
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
author: Sittikorn S, Nuttakorn T
date: 2021/07/01
modified: 2021/11/23
tags:
    - attack.privilege_escalation
    - attack.t1055
logsource:
    product: antivirus
detection:
    selection:
        Filename|contains: 'C:\Windows\System32\spool\drivers\x64\'
    condition: selection
fields:
    - Signature
    - Filename
    - ComputerName
falsepositives:
    - Unlikely
level: critical

Antivirus Relevant File Paths Alerts

title: Antivirus Relevant File Paths Alerts
id: c9a88268-0047-4824-ba6e-4d81ce0b907c
description: Detects an Antivirus alert in a highly relevant file path or with a relevant file name
status: experimental
date: 2018/09/09
modified: 2021/11/23
author: Florian Roth, Arnim Rupp
references:
    - https://www.nextron-systems.com/2021/03/25/antivirus-event-analysis-cheat-sheet-v1-8/
logsource:
    product: antivirus
detection:
    selection:
        - Filename|startswith:
            - 'C:\Windows\'
            - 'C:\Temp\'
            - 'C:\PerfLogs\'
            - 'C:\Users\Public\'
            - 'C:\Users\Default\'
        - Filename|contains:
            - '\Client\'
            - '\tsclient\'
            - '\inetpub\'
            - '/www/'
            - 'apache'
            - 'tomcat'
            - 'nginx'
            - 'weblogic'
    selection2:
        Filename|endswith:
            - '.ps1'
            - '.psm1'
            - '.vbs'
            - '.bat'
            - '.cmd'
            - '.sh'
            - '.chm'
            - '.xml'
            - '.txt'
            - '.jsp'
            - '.jspx'
            - '.asp'
            - '.aspx'
            - '.ashx'
            - '.asax'
            - '.asmx'
            - '.php'
            - '.cfm'
            - '.py'
            - '.pyc'
            - '.pl'
            - '.rb'
            - '.cgi'
            - '.war'
            - '.ear'
            - '.hta'
            - '.lnk'
            - '.scf'
            - '.sct'
            - '.vbe'
            - '.wsf'
            - '.wsh'
            - '.gif'
            - '.png'
            - '.jpg'
            - '.jpeg'
            - '.svg'
            - '.dat'
    condition: selection or selection2
fields:
    - Signature
    - User
falsepositives:
    - Unlikely
level: high
tags:
    - attack.resource_development
    - attack.t1588

Antivirus Web Shell Detection

title: Antivirus Web Shell Detection
id: fdf135a2-9241-4f96-a114-bb404948f736
description: Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big webshell repo from e.g. github and checking the matches.
status: experimental
date: 2018/09/09
modified: 2021/05/08
author: Florian Roth, Arnim Rupp
references:
    - https://www.nextron-systems.com/2021/03/25/antivirus-event-analysis-cheat-sheet-v1-8/
    - https://github.com/tennc/webshell
    - https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection
    - https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection
    - https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f382789247329ad2d7782a72dde9867941f13266310c80/detection
    - https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection
    - https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection
    - https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection
    - https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    product: antivirus
detection:
    selection:
        - Signature|startswith:
            - 'PHP/'
            - 'JSP/'
            - 'ASP/'
            - 'Perl/'
            - 'PHP.'
            - 'JSP.'
            - 'ASP.'
            - 'Perl.'
            - 'VBS/Uxor' # looking for 'VBS/' would also find downloaders and droppers meant for desktops
            - 'IIS/BackDoor'
            - 'JAVA/Backdoor'
            - 'Troj/ASP'
            - 'Troj/PHP'
            - 'Troj/JSP'
        - Signature|contains:
            - 'Webshell'
            - 'Chopper'
            - 'SinoChoper'
            - 'ASPXSpy'
            - 'Aspdoor'
            - 'filebrowser'
            - 'PHP_'
            - 'JSP_'
            - 'ASP_' # looking for 'VBS_' would also find downloaders and droppers meant for desktops
            - 'PHP:'
            - 'JSP:'
            - 'ASP:'
            - 'Perl:'
            - 'PHPShell'
            - 'Trojan.PHP'
            - 'Trojan.ASP'
            - 'Trojan.JSP'
            - 'Trojan.VBS'
            - 'PHP?Agent'
            - 'ASP?Agent'
            - 'JSP?Agent'
            - 'VBS?Agent'
            - 'Backdoor?PHP'
            - 'Backdoor?JSP'
            - 'Backdoor?ASP'
            - 'Backdoor?VBS'
            - 'Backdoor?Java'
    condition: selection
fields:
    - FileName
    - User
falsepositives:
    - Unlikely
level: critical

django

Django Framework Exceptions

title: Django Framework Exceptions
id: fd435618-981e-4a7c-81f8-f78ce480d616
status: stable
description: Detects suspicious Django web application framework exceptions that could indicate exploitation attempts
author: Thomas Patzke
date: 2017/08/05
modified: 2020/09/01
references:
    - https://docs.djangoproject.com/en/1.11/ref/exceptions/
    - https://docs.djangoproject.com/en/1.11/topics/logging/#django-security
logsource:
    category: application
    product: django
detection:
    keywords:
        - SuspiciousOperation
        # Subclasses of SuspiciousOperation
        - DisallowedHost
        - DisallowedModelAdminLookup
        - DisallowedModelAdminToField
        - DisallowedRedirect
        - InvalidSessionKey
        - RequestDataTooBig
        - SuspiciousFileOperation
        - SuspiciousMultipartForm
        - SuspiciousSession
        - TooManyFieldsSent
        # Further security-related exceptions
        - PermissionDenied
    condition: keywords
falsepositives:
    - Application bugs
    - Penetration testing
level: medium
tags:
    - attack.initial_access
    - attack.t1190

edr/windows

EDR WMI Command Execution by Office Applications

title: EDR WMI Command Execution by Office Applications
id: 3ee1bba8-b9e2-4e35-bec5-7fb66b6b3815
description: Initial execution of malicious document calls wmic Win32_Process::Create to execute the file with regsvr32
references:
    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
    - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/main/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
author: 'Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule)'
tags:
    - attack.t1204.002
    - attack.t1047
    - attack.t1218.010
    - attack.execution
    - attack.defense_evasion
status: experimental
date: 2021/08/23
modified: 2021/11/09
logsource:
  product: windows
  category: edr
detection:
  #useful_information: Add more office applications to the rule logic of choice
  selection1:
    EventLog: EDR
    EventType: WMIExecution
    WMIcommand|contains: 'Win32_Process\:\:Create'
  selection2:
    Image|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
  condition: selection1 and selection2
falsepositives:
- Unknown
level: high

python

Python SQL Exceptions

title: Python SQL Exceptions
id: 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9
status: stable
description: Generic rule for SQL exceptions in Python according to PEP 249
author: Thomas Patzke
date: 2017/08/12
modified: 2020/09/01
references:
    - https://www.python.org/dev/peps/pep-0249/#exceptions
logsource:
    category: application
    product: python
detection:
    exceptions:
        - DataError
        - IntegrityError
        - ProgrammingError
        - OperationalError
    condition: exceptions
falsepositives:
    - Application bugs
    - Penetration testing
level: medium
tags:
    - attack.initial_access
    - attack.t1190

rpc_firewall

Remote Schedule Task Lateral Movement via ATSvc

title: Remote Schedule Task Lateral Movement via ATSvc
id: 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb
description: Detects remote RPC calls to create or execute a scheduled task via ATSvc
references:
    - https://attack.mitre.org/techniques/T1053/
    - https://attack.mitre.org/tactics/TA0008/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-TSCH.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.lateral_movement
    - attack.t1053
    - attack.t1053.002
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b
        OpNum:
          - 0
          - 1
    condition: selection
falsepositives:
    - unknown
level: high

Remote Schedule Task Recon via AtScv


title: Remote Schedule Task Recon via AtScv
id: f177f2bc-5f3e-4453-b599-57eefce9a59c
description: Detects remote RPC calls to read information about scheduled tasks via AtScv
references:
    - https://attack.mitre.org/tactics/TA0007/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
    - https://github.com/zeronetworks/rpcfirewall
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-TSCH.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b
    filter:
      OpNum:
        - 0
        - 1
    condition: selection and not filter
falsepositives:
    - unknown
level: high

Possible DCSync Attack

title: Possible DCSync Attack
id: 56fda488-113e-4ce9-8076-afc2457922c3
description: Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.
references:
    - https://attack.mitre.org/techniques/T1033/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-DRSR.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.t1033
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for "dangerous" opcodes (not 0,1 or 12) only from trusted IPs (DCs)'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: e3514235-4b06-11d1-ab04-00c04fc2dcd2
    filter:
      OpNum:
        - 0
        - 1
        - 12
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

Remote Encrypting File System Abuse

title: Remote Encrypting File System Abuse
id: 5f92fff9-82e2-48eb-8fc1-8b133556a551
description: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR
references:
    - https://attack.mitre.org/tactics/TA0008/
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-EFSR.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.lateral_movement
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:df1941c5-fe89-4e79-bf10-463657acf44d or c681d488-d850-11d0-8c52-00c04fd90f7e'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid:
          - df1941c5-fe89-4e79-bf10-463657acf44d
          - c681d488-d850-11d0-8c52-00c04fd90f7e
    condition: selection
falsepositives:
    - Legitimate usage of remote file encryption
level: high

Remote Event Log Recon

title: Remote Event Log Recon
id: 2053961f-44c7-4a64-b62d-f6e72800af0d
description: Detects remote RPC calls to get event log information via EVEN or EVEN6
references:
    - https://attack.mitre.org/tactics/TA0007/
    - https://github.com/zeronetworks/rpcfirewall
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:82273fdc-e32a-18c3-3f78-827929dc23ea and uuid:f6beaff7-1e19-4fbb-9f8f-b89e2018337c"'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid:
          - 82273fdc-e32a-18c3-3f78-827929dc23ea
          - f6beaff7-1e19-4fbb-9f8f-b89e2018337c
    condition: selection
falsepositives:
    - remote administrative tasks on Windows Events
level: high

Remote Schedule Task Lateral Movement via ITaskSchedulerService

title: Remote Schedule Task Lateral Movement via ITaskSchedulerService
id: ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d
description: Detects remote RPC calls to create or execute a scheduled task
references:
    - https://attack.mitre.org/techniques/T1053/
    - https://attack.mitre.org/tactics/TA0008/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-TSCH.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.lateral_movement
    - attack.t1053
    - attack.t1053.002
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c
        OpNum:
          - 1
          - 3
          - 4
          - 10
          - 11
          - 12
          - 13
          - 14
          - 15
    condition: selection
falsepositives:
    - unknown
level: high

Remote Schedule Task Recon via ITaskSchedulerService

title: Remote Schedule Task Recon via ITaskSchedulerService
id: 7f7c49eb-2977-4ac8-8ab0-ab1bae14730e
description: Detects remote RPC calls to read information about scheduled tasks
references:
    - https://attack.mitre.org/tactics/TA0007/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-TSCH.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c
    filter:
      OpNum:
        - 1
        - 3
        - 4
        - 10
        - 11
        - 12
        - 13
        - 14
        - 15
    condition: selection and not filter
falsepositives:
    - unknown
level: high

Remote Printing Abuse for Lateral Movement

title: Remote Printing Abuse for Lateral Movement
id: bc3a4b0c-e167-48e1-aa88-b3020950e560
description: Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR
references:
    - https://attack.mitre.org/tactics/TA0008/
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-RPRN-PAR.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.lateral_movement
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:12345678-1234-abcd-ef00-0123456789ab or 76f03f96-cdfd-44fc-a22c-64950a001209 or ae33069b-a2a8-46ee-a235-ddfd339be281 or 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid:
          - 12345678-1234-abcd-ef00-0123456789ab
          - 76f03f96-cdfd-44fc-a22c-64950a001209
          - 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1
          - ae33069b-a2a8-46ee-a235-ddfd339be281
    condition: selection
falsepositives:
    - actual printing
level: high

Remote DCOM/WMI Lateral Movement

title: Remote DCOM/WMI Lateral Movement
id: 68050b10-e477-4377-a99b-3721b422d6ef
description: Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.
references:
    - https://attack.mitre.org/tactics/TA0008/
    - https://attack.mitre.org/techniques/T1021/003/
    - https://attack.mitre.org/techniques/T1047/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.lateral_movement
    - attack.t1021.003
    - attack.t1047
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:367abb81-9844-35f1-ad32-98f038001003'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid:
          - 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57
          - 99fcfec4-5260-101b-bbcb-00aa0021347a
          - 000001a0-0000-0000-c000-000000000046
          - 00000131-0000-0000-c000-000000000046
          - 00000143-0000-0000-c000-000000000046
          - 00000000-0000-0000-c000-000000000046
    condition: selection
falsepositives:
    - Some administrative tasks on remote host
level: high

Remote Registry Lateral Movement

title: Remote Registry Lateral Movement
id: 35c55673-84ca-4e99-8d09-e334f3c29539
description: Detects remote RPC calls to modify the registry and possible execute code
references:
    - https://attack.mitre.org/techniques/T1112/
    - https://attack.mitre.org/tactics/TA0008/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-RRP.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.lateral_movement
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003"'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 338cd001-2244-31f1-aaaa-900038001003
        OpNum:
          - 6
          - 7
          - 8
          - 13
          - 18
          - 19
          - 21
          - 22
          - 23
          - 35
    condition: selection
falsepositives:
    - Remote administration of registry values
level: high

Remote Registry Recon

title: Remote Registry Recon
id: d8ffe17e-04be-4886-beb9-c1dd1944b9a8
description: Detects remote RPC calls to collect information
references:
    - https://attack.mitre.org/tactics/TA0007/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-RRP.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003"'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 338cd001-2244-31f1-aaaa-900038001003
    filter:
      OpNum:
        - 6
        - 7
        - 8
        - 13
        - 18
        - 19
        - 21
        - 22
        - 23
        - 35
    condition: selection and not filter
falsepositives:
    - Remote administration of registry values
level: high

Remote Server Service Abuse

title: Remote Server Service Abuse
id: b6ea3cc7-542f-43ef-bbe4-980fbed444c7
description: Detects remote RPC calls to possibly abuse remote encryption service via MS-SRVS
references:
    - https://attack.mitre.org/tactics/TA0008/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-SRVS.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.lateral_movement
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188
    condition: selection
falsepositives:
    - Legitimate remote share creation
level: high

Remote Server Service Abuse for Lateral Movement

title: Remote Server Service Abuse for Lateral Movement
id: 10018e73-06ec-46ec-8107-9172f1e04ff2
description: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR
references:
    - https://attack.mitre.org/tactics/TA0008/
    - https://attack.mitre.org/techniques/T1569/002/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-SCMR.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.lateral_movement
    - attack.t1569.002
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:367abb81-9844-35f1-ad32-98f038001003'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 367abb81-9844-35f1-ad32-98f038001003
    condition: selection
falsepositives:
    - Administrative tasks on remote services
level: high

Remote Schedule Task Lateral Movement via SASec

title: Remote Schedule Task Lateral Movement via SASec
id: aff229ab-f8cd-447b-b215-084d11e79eb0
description: Detects remote RPC calls to create or execute a scheduled task via SASec
references:
    - https://attack.mitre.org/techniques/T1053/
    - https://attack.mitre.org/tactics/TA0008/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-TSCH.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.lateral_movement
    - attack.t1053
    - attack.t1053.002
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f"'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 378e52b0-c0a9-11cf-822d-00aa0051e40f
        OpNum:
          - 0
          - 1
    condition: selection
falsepositives:
    - unknown
level: high

Remote Schedule Task Lateral Movement via SASec

title: Remote Schedule Task Lateral Movement via SASec
id: 0a3ff354-93fc-4273-8a03-1078782de5b7
description: Detects remote RPC calls to read information about scheduled tasks via SASec
references:
    - https://attack.mitre.org/tactics/TA0007/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-TSCH.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f"'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 378e52b0-c0a9-11cf-822d-00aa0051e40f
    filter:
      OpNum:
        - 0
        - 1
    condition: selection and not filter
falsepositives:
    - unknown
level: high

SharpHound Recon Account Discovery

title: SharpHound Recon Account Discovery
id: 65f77b1e-8e79-45bf-bb67-5988a8ce45a5
description: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
references:
    - https://attack.mitre.org/techniques/T1087/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-WKST.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.t1087
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:6bffd098-a112-3610-9833-46c3f87e345a opnum:2'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 6bffd098-a112-3610-9833-46c3f87e345a
        OpNum: 2
    condition: selection
falsepositives:
    - Unknown
level: high

SharpHound Recon Sessions

title: SharpHound Recon Sessions
id: 6d580420-ff3f-4e0e-b6b0-41b90c787e28
description: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
references:
    - https://attack.mitre.org/techniques/T1033/
    - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/main/documents/MS-SRVS.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping_lateral_movement_via_the_rpc_firewall/
tags:
    - attack.t1033
status: experimental
author: Sagie Dulce, Dekel Paz
date: 2022/01/01
modified: 2022/01/01
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188 opnum:12'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188
        OpNum: 12
    condition: selection
falsepositives:
    - Unknown
level: high

ruby

Ruby on Rails Framework Exceptions

title: Ruby on Rails Framework Exceptions
id: 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a
status: stable
description: Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
author: Thomas Patzke
date: 2017/08/06
modified: 2020/09/01
references:
    - http://edgeguides.rubyonrails.org/security.html
    - http://guides.rubyonrails.org/action_controller_overview.html
    - https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception
    - https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb
logsource:
    category: application
    product: ruby_on_rails
detection:
    keywords:
        - ActionController::InvalidAuthenticityToken
        - ActionController::InvalidCrossOriginRequest
        - ActionController::MethodNotAllowed
        - ActionController::BadRequest
        - ActionController::ParameterMissing
    condition: keywords
falsepositives:
    - Application bugs
    - Penetration testing
level: medium
tags:
    - attack.initial_access
    - attack.t1190

spring

Spring Framework Exceptions

title: Spring Framework Exceptions
id: ae48ab93-45f7-4051-9dfe-5d30a3f78e33
status: stable
description: Detects suspicious Spring framework exceptions that could indicate exploitation attempts
author: Thomas Patzke
date: 2017/08/06
modified: 2020/09/01
references:
    - https://docs.spring.io/spring-security/site/docs/current/apidocs/overview-tree.html
logsource:
    category: application
    product: spring
detection:
    keywords:
        - AccessDeniedException
        - CsrfException
        - InvalidCsrfTokenException
        - MissingCsrfTokenException
        - CookieTheftException
        - InvalidCookieException
        - RequestRejectedException
    condition: keywords
falsepositives:
    - Application bugs
    - Penetration testing
level: medium
tags:
    - attack.initial_access
    - attack.t1190

sql

Suspicious SQL Error Messages

title: Suspicious SQL Error Messages
id: 8a670c6d-7189-4b1c-8017-a417ca84a086
status: test
description: Detects SQL error messages that indicate probing for an injection attack
author: Bjoern Kimminich
references:
  - http://www.sqlinjection.net/errors
date: 2017/11/27
modified: 2021/11/27
logsource:
  category: application
  product: sql
detection:
  keywords:
        # Oracle
    - quoted string not properly terminated
        # MySQL
    - You have an error in your SQL syntax
        # SQL Server
    - Unclosed quotation mark
        # SQLite
    - 'near "*": syntax error'
    - SELECTs to the left and right of UNION do not have the same number of result columns
  condition: keywords
falsepositives:
  - Application bugs
level: high
tags:
  - attack.initial_access
  - attack.t1190

apt

Silence.Downloader V3

title: Silence.Downloader V3
id: 170901d1-de11-4de7-bccb-8fa13678d857
status: test
description: Detects Silence downloader. These commands are hardcoded into the binary.
author: Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community
date: 2019/11/01
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection_recon:
    Image|endswith:
      - '\tasklist.exe'
      - '\qwinsta.exe'
      - '\ipconfig.exe'
      - '\hostname.exe'
    CommandLine|contains: '>>'
    CommandLine|endswith: 'temps.dat'
  selection_persistence:
    CommandLine|contains: '/C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinNetworkSecurity" /t REG_SZ /d'
  condition: selection_recon | near selection_persistence   # requires both
fields:
  - ComputerName
  - User
  - Image
  - CommandLine
falsepositives:
  - Unknown
level: high
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.discovery
  - attack.t1057
  - attack.t1082
  - attack.t1016
  - attack.t1033
  - attack.g0091

Silence EDA Detection

title: Silence EDA Detection
id: 3ceb2083-a27f-449a-be33-14ec1b7cc973
status: test
description: Detects Silence empireDNSagent
author: Alina Stepchenkova, Group-IB, oscd.community
date: 2019/11/01
modified: 2021/11/27
logsource:
  product: windows
  service: powershell
detection:
  empire:
    ScriptBlockText|contains|all:               # better to randomise the order
      - 'System.Diagnostics.Process'
      - 'Stop-Computer'
      - 'Restart-Computer'
      - 'Exception in execution'
      - '$cmdargs'
      - 'Close-Dnscat2Tunnel'
  dnscat:
    ScriptBlockText|contains|all:               # better to randomise the order
      - 'set type=$LookupType`nserver'
      - '$Command | nslookup 2>&1 | Out-String'
      - 'New-RandomDNSField'
      - '[Convert]::ToString($SYNOptions, 16)'
      - '$Session.Dead = $True'
      - '$Session["Driver"] -eq'
  condition: empire and dnscat
falsepositives:
  - Unknown
level: critical
tags:
  - attack.execution
  - attack.t1059.001
  - attack.command_and_control
  - attack.t1071.004
  - attack.t1572
  - attack.impact
  - attack.t1529
  - attack.g0091
  - attack.s0363

cloud

aws

azure

gcp

gworkspace

m365

okta

onelogin

compliance

default_credentials_usage.yml
firewall_cleartext_protocols.yml
group_modification_logging.yml
Changedoublequotetoquote
host_without_firewall.yml
netflow_cleartext_protocols.yml
splitglobalcleartext_protocols.yml
workstation_was_locked.yml

generic

Brute Force

title: Brute Force
id: 53c7cca0-2901-493a-95db-d00d6fcf0a37
status: test
description: Detects many authentication failures from one source to one destination which is may indicate Brute Force activity
author: Aleksandr Akhremchik, oscd.community
date: 2019/10/25
modified: 2021/11/27
logsource:
  category: authentication
detection:
  selection:
    action: failure
  timeframe: 600s
  condition: selection | count(category) by dst_ip > 30
fields:
  - src_ip
  - dst_ip
  - user
falsepositives:
  - Inventarization
  - Penetration testing
  - Vulnerability scanner
  - Legitimate application
level: medium
tags:
  - attack.credential_access
  - attack.t1110

linux

auditd

builtin

file_create

macos

modsecurity

network_connection

other

process_creation

cisco/aaa

cisco_cli_clear_logs.yml
cisco_cli_collect_data.yml
cisco_cli_crypto_actions.yml
cisco_cli_disable_logging.yml
cisco_cli_discovery.yml
cisco_cli_dos.yml
cisco_cli_file_deletion.yml
cisco_cli_input_capture.yml
cisco_cli_local_accounts.yml
cisco_cli_modify_config.yml
cisco_cli_moving_data.yml
cisco_cli_net_sniff.yml

zeek

zeek_dce_rpc_domain_user_enumeration.yml
zeek_dce_rpc_mitre_bzar_execution.yml
zeek_dce_rpc_mitre_bzar_persistence.yml
zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml
zeek_dce_rpc_printnightmare_print_driver_install.yml
zeek_dce_rpc_smb_spoolss_named_pipe.yml
zeek_default_cobalt_strike_certificate.yml
zeek_dns_mining_pools.yml
zeek_dns_suspicious_zbit_flag.yml
zeek_dns_torproxy.yml
zeek_http_executable_download_from_webdav.yml
zeek_http_omigod_no_auth_rce.yml
zeek_http_webdav_put_request.yml
zeek_rdp_public_listener.yml
zeek_smb_converted_win_atsvc_task.yml
zeek_smb_converted_win_impacket_secretdump.yml
zeek_smb_converted_win_lm_namedpipe.yml
zeek_smb_converted_win_susp_psexec.yml
zeek_smb_converted_win_susp_raccess_sensitive_fext.yml
zeek_smb_converted_win_transferring_files_with_credential_data.yml
zeek_susp_kerberos_rc4.yml

proxy

proxy_download_susp_dyndns.yml
proxy_download_susp_tlds_blacklist.yml
proxy_download_susp_tlds_whitelist.yml
proxy_downloadcradle_webdav.yml
proxy_empire_ua_uri_combos.yml
proxy_empty_ua.yml
proxy_ios_implant.yml
proxy_java_class_download.yml
proxy_pwndrop.yml
proxy_raw_paste_service_access.yml
proxy_susp_flash_download_loc.yml
proxy_telegram_api.yml
proxy_ua_bitsadmin_susp_tld.yml
proxy_ua_cryptominer.yml
proxy_ua_frameworks.yml
proxy_ua_hacktool.yml
proxy_ua_malware.yml
proxy_ua_suspicious.yml
proxy_ursnif_malware_c2_url.yml
proxy_ursnif_malware_download_url.yml

APT

APT40 Dropbox Tool User Agent

title: APT40 Dropbox Tool User Agent
id: 5ba715b6-71b7-44fd-8245-f66893e81b3d
status: test
description: Detects suspicious user agent string of APT40 Dropbox tool
author: Thomas Patzke
references:
  - Internal research from Florian Roth
date: 2019/11/12
modified: 2021/11/27
logsource:
  category: proxy
detection:
  selection:
    c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36'
    r-dns: 'api.dropbox.com'
  condition: selection
fields:
  - c-ip
  - c-uri
falsepositives:
  - Old browsers
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1567.002

Domestic Kitten FurBall Malware Pattern

title: Domestic Kitten FurBall Malware Pattern
id: 6c939dfa-c710-4e12-a4dd-47e1f10e68e1
status: experimental
description: Detects specific malware patterns used by FurBall malware linked to Iranian Domestic Kitten APT group
author: Florian Roth
references:
    - https://research.checkpoint.com/2021/domestic-kitten-an-inside-look-at-the-iranian-surveillance-operations/
date: 2021/02/08
tags:
    - attack.command_and_control
logsource:
    category: proxy
detection:
    selection:
        c-uri|contains: 
            - 'Get~~~AllBrowser'
            - 'Get~~~HardwareInfo'
            - 'Take~~RecordCall'
            - 'Reset~~~AllCommand'
    condition: selection
fields:
    - c-ip
    - c-uri
falsepositives:
    - Unlikely
level: high

BabyShark Agent Pattern

title: BabyShark Agent Pattern
id: 304810ed-8853-437f-9e36-c4975c3dfd7e
status: experimental
description: Detects Baby Shark C2 Framework communication patterns
author: Florian Roth
date: 2021/06/09
references:
    - https://nasbench.medium.com/understanding-detecting-c2-frameworks-babyshark-641be4595845
logsource:
    category: proxy
detection:
    selection:
        c-uri|contains: 'momyshark?key='
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001

Chafer Malware URL Pattern

title: Chafer Malware URL Pattern
id: fb502828-2db0-438e-93e6-801c7548686d
status: test
description: Detects HTTP requests used by Chafer malware
author: Florian Roth
references:
  - https://securelist.com/chafer-used-remexi-malware/89538/
date: 2019/01/31
modified: 2021/11/27
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: '/asp.asp?ui='
  condition: selection
fields:
  - ClientIP
  - c-uri
  - c-useragent
falsepositives:
  - Unknown
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001

Turla ComRAT

title: Turla ComRAT
id: 7857f021-007f-4928-8b2c-7aedbe64bb82
status: test
description: Detects Turla ComRAT patterns
author: Florian Roth
references:
  - https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
date: 2020/05/26
modified: 2021/11/27
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: '/index/index.php?h='
  condition: selection
falsepositives:
  - Unknown
level: critical
tags:
  - attack.defense_evasion
  - attack.command_and_control
  - attack.t1071.001
  - attack.g0010

APT UserAgent

title: APT UserAgent
id: 6ec820f2-e963-4801-9127-d8b2dce4d31b
status: test
description: Detects suspicious user agent strings used in APT malware in proxy logs
author: Florian Roth, Markus Neis
references:
  - Internal Research
date: 2019/11/12
modified: 2021/11/30
logsource:
  category: proxy
detection:
  selection:
    c-useragent:
         # APT Related
      - 'SJZJ (compatible; MSIE 6.0; Win32)'    # APT Backspace
      - 'Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0'    # APT GrizzlySteppe - ChopStick - US CERT https://goo.gl/1DTHwi
      - 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC'    # Comment Crew Miniasp
      - 'Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)'    # Comment Crew Miniasp
      - 'webclient'    # Naikon APT
      - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200'    # Naikon APT
      - 'Mozilla/4.0 (compatible; MSI 6.0;'    # SnowGlobe Babar - yes, it is cut
      - 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0'    # Sofacy - Xtunnel
      - 'Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/'    # Sofacy - Xtunnel
      - 'Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2'    # Sofacy - Xtunnel
      - 'Mozilla/4.0'    # Derusbi backdoor ELF https://github.com/fideliscyber/indicators/tree/master/FTA-1021
      - 'Netscape'    # Unit78020 Malware
      - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7'    # Unit78020 Malware
      - 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Firefox/3.6.13 GTB7.1'    # Winnti related
      - 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)'    # Winnti related
      - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)'    # APT17
      - 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)'    # Bronze Butler - Daserf
      - 'Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)'    # Bronze Butler - Daserf
      - 'Mozilla/4.0 (compatible; MSIE 8.0; Win32)'    # TSCookie https://app.any.run/tasks/0996b314-5133-491b-8d23-d431ffdec597
      - 'Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1'    # Delphi downloader https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/
      - 'Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0)'    # VPNFilter https://blog.talosintelligence.com/2018/05/VPNFilter.html
      - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1)'    # Sofacy User-Agent https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/
      - 'Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko'    # Sofacy User-Agent https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/
      - 'Mozilla v5.1 *'    # Sofacy Zebrocy samples
      - 'MSIE 8.0'    # Sofacy Azzy Backdoor  from https://www.hybrid-analysis.com/sample/a80e29c0757bee05338fd5c22a542d852ad86c477068e3eb4aacc1c3e59e2eef?environmentId=100
      - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)'    # https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html
      - 'Mozilla/4.0 (compatible; RMS)'    # Attacks on industrial enterprises using RMS and TeamViewer https://goo.gl/GthvTw
      - 'Mozilla/4.0 (compatible; MSIE 6.0; DynGate)'    # Attacks on industrial enterprises using RMS and TeamViewer https://goo.gl/GthvTw
      - 'O/9.27 (W; U; Z)'   # Cmstar https://www.virustotal.com/#/file/e4328011bb2b04abc856ccd04404c9f95d67167f6c291d343e8ffa8aa2aa2099/details
      - 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0;  Trident/5.0*'    # KerrDown UA https://goo.gl/s2WU6o
      - 'Mozilla/5.0 (Windows NT 9; *'    # Suspicious 'Windows NT 9' user agent - used by APT33 malware in 2018
      - 'hots scot'    # Unknown iOS zero-day implant https://twitter.com/craiu/status/1176437994288484352?s=20
      - 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT)'    # https://blog.telsy.com/meeting-powerband-the-apt33-net-powerton-variant/
      - 'Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36'    # Hidden Cobra malware
      - 'Mozilla/5.0 (Windows NT 6.2; Win32; rv:47.0)'    # Strong Pity loader https://twitter.com/VK_Intel/status/1264185981118406657
      - 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;SV1;'    # Mustang Panda https://insights.oem.avira.com/new-wave-of-plugx-targets-hong-kong/
      - 'Mozilla/5.0 (X11; Linux i686; rv:22.0) Firefox/22.0'    # BackdoorDiplomacy https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/
      - 'Mozilla/5.0 Chrome/72.0.3626.109 Safari/537.36'    # SideWalk malware used by Sparkling Goblin
      - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:FTS_06) Gecko/22.36.35.06 Firefox/2.0'  # LitePower stager used by WRITE https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/
  condition: selection
fields:
  - ClientIP
  - c-uri
  - c-useragent
falsepositives:
  - Old browsers
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001

CobaltStrike

🙋‍♀️🙋‍♀️🙋‍♀️Cobalt Strike Malleable Amazon Browsing Traffic Profile

title: CobaltStrike Malleable Amazon Browsing Traffic Profile
id: 953b895e-5cc9-454b-b183-7f3db555452e
status: test
description: Detects Malleable Amazon Profile
author: Markus Neis
references:
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/normal/amazon.profile
  - https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100
date: 2019/11/12
modified: 2021/11/27
logsource:
  category: proxy
detection:
  selection1:
    c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'
    cs-method: 'GET'
    c-uri: '/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books'
    cs-host: 'www.amazon.com'
    cs-cookie|endswith: '=csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996'
  selection2:
    c-useragent: 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'
    cs-method: 'POST'
    c-uri: '/N4215/adj/amzn.us.sr.aps'
    cs-host: 'www.amazon.com'
  condition: selection1 or selection2
falsepositives:
  - Unknown
level: high
tags:
  - attack.defense_evasion
  - attack.command_and_control
  - attack.t1071.001

🙋‍♀️🙋‍♀️🙋‍♀️Cobalt Strike Malformed UAs in Malleable Profiles

title: CobaltStrike Malformed UAs in Malleable Profiles
id: 41b42a36-f62c-4c34-bd40-8cb804a34ad8
status: experimental
description: Detects different malformed user agents used in Malleable Profiles used with Cobalt Strike
author: Florian Roth
date: 2021/05/06
modified: 2021/11/02
references:
  - https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/
logsource:
  category: proxy
detection:
  selection1:
    c-useragent: 
      - 'Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)'
      - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )'
      - 'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08'
  selection2:
    c-useragent|endswith: '; MANM; MANM)'
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
tags:
  - attack.defense_evasion
  - attack.command_and_control
  - attack.t1071.001

CobaltStrike Malleable (OCSP) Profile

title: CobaltStrike Malleable (OCSP) Profile
id: 37325383-740a-403d-b1a2-b2b4ab7992e7
status: test
description: Detects Malleable (OCSP) Profile with Typo (OSCP) in URL
author: Markus Neis
references:
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/normal/ocsp.profile
date: 2019/11/12
modified: 2021/11/27
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: '/oscp/'
    cs-host: 'ocsp.verisign.com'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.defense_evasion
  - attack.command_and_control
  - attack.t1071.001

CobaltStrike Malleable OneDrive Browsing Traffic Profile

title: CobaltStrike Malleable OneDrive Browsing Traffic Profile
id: c9b33401-cc6a-4cf6-83bb-57ddcb2407fc
status: test
description: Detects Malleable OneDrive Profile
author: Markus Neis
references:
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/master/normal/onedrive_getonly.profile
date: 2019/11/12
modified: 2022/01/07
logsource:
  category: proxy
detection:
  selection:
    cs-method: 'GET'
    c-uri|endswith: '?manifest=wac'
    cs-host: 'onedrive.live.com'
  filter:
    c-uri|startswith: 'http'
    c-uri|contains: '://onedrive.live.com/'
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
tags:
  - attack.defense_evasion
  - attack.command_and_control
  - attack.t1071.001

Windows PowerShell User Agent

title: Windows PowerShell User Agent
id: c8557060-9221-4448-8794-96320e6f3e74
status: test
description: Detects Windows PowerShell Web Access
author: Florian Roth
references:
  - https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest
date: 2017/03/13
modified: 2021/11/27
logsource:
  category: proxy
detection:
  selection:
    c-useragent|contains: ' WindowsPowerShell/'
  condition: selection
fields:
  - ClientIP
  - c-uri
  - c-useragent
falsepositives:
  - Administrative scripts that download files from the Internet
  - Administrative scripts that retrieve certain website contents
level: medium
tags:
  - attack.defense_evasion
  - attack.command_and_control
  - attack.t1071.001

web

web_apache_segfault.yml
web_apache_threading_error.yml
web_arcadyan_router_cve_2021_20090_2021_20091_exploit.yml
web_citrix_cve_2019_19781_exploit.yml
web_citrix_cve_2020_8193_8195_exploit.yml
web_cve_2010_5278_exploitation_attempt.yml
web_cve_2018_2894_weblogic_exploit.yml
web_cve_2019_3398_confluence.yml
web_cve_2020_0688_msexchange.yml
web_cve_2020_14882_weblogic_exploit.yml
web_cve_2020_3452_cisco_asa_ftd.yml
web_cve_2020_5902_f5_bigip.yml
web_cve_2021_2109_weblogic_rce_exploit.yml
web_cve_2021_21978_vmware_view_planner_exploit.yml
web_cve_2021_22005_vmware_file_upload.yml
Updateweb_cve_2021_22005_vmware_file_upload.yml
web_cve_2021_22893_pulse_secure_rce_exploit.yml
web_cve_2021_26814_wzuh_rce.yml
web_cve_2021_26858_iis_rce.yml
web_cve_2021_33766_msexchange_proxytoken.yml
web_cve_2021_40539_adselfservice.yml
Updateweb_cve_2021_40539_adselfservice.yml
web_cve_2021_40539_manageengine_adselfservice_exploit.yml
Updateweb_cve_2021_40539_manageengine_adselfservice_exploit.yml
web_cve_2021_41773_apache_path_traversal.yml
web_cve_2021_42237_sitecore_report_ashx.yml
web_cve_2021_43798_grafana.yml
web_cve_2021_44228_log4j.yml
web_cve_2021_44228_log4j_fields.yml
web_exchange_cve_2020_0688_exploit.yml
web_exchange_exploitation_hafnium.yml
web_exchange_proxyshell.yml
web_exchange_proxyshell_successful.yml
web_expl_exchange_cve_2021_28480.yml
web_fortinet_cve_2018_13379_preauth_read_exploit.yml
web_fortinet_cve_2021_22123_exploit.yml
web_iis_tilt_shortname_scan.yml
web_jndi_exploit.yml
web_multiple_suspicious_resp_codes_single_source.yml
web_nginx_core_dump.yml
web_path_traversal_exploitation_attempt.yml
web_pulsesecure_cve_2019_11510.yml
web_solarwinds_cve_2020_10148.yml
web_solarwinds_supernova_webshell.yml
web_sonicwall_jarrewrite_exploit.yml
web_source_code_enumeration.yml
web_terramaster_cve_2020_28188_rce_exploit.yml
web_unc2546_dewmode_php_webshell.yml
web_vsphere_cve_2021_21972_unauth_rce_exploit.yml
win_powershell_snapins_hafnium.yml
win_webshell_regeorg.yml

KeyWords

Detect Sql Injection By Keywords

title: Detect Sql Injection By Keywords
id: 5513deaf-f49a-46c2-a6c8-3f111b5cb453
status: test
description: Detects sql injection that use GET requests by keyword searches in URL strings
author: Saw Win Naung
date: 2020/02/22
modified: 2021/11/27
logsource:
  category: webserver
detection:
  keywords:
    - '=select'
    - '=union'
    - '=concat'
  condition: keywords
fields:
  - client_ip
  - vhost
  - url
  - response
falsepositives:
  - Java scripts and CSS Files
  - User searches in search boxes of the respective website
level: high

Webshell Detection by Keyword

title: Webshell Detection by Keyword
id: 7ff9db12-1b94-4a79-ba68-a2402c5d6729
status: test
description: Detects webshells that use GET requests by keyword searches in URL strings
author: Florian Roth
date: 2017/02/19
modified: 2021/11/27
logsource:
  category: webserver
detection:
  keywords:
    - =whoami
    - =net%20user
    - =cmd%20/c%20
  condition: keywords
fields:
  - client_ip
  - vhost
  - url
  - response
falsepositives:
  - Web sites like wikis with articles on os commands and pages that include the os commands in the URLs
  - User searches in search boxes of the respective website
level: high
tags:
  - attack.persistence
  - attack.t1505.003

Detect XSS Attempts By Keywords

title: Detect XSS Attempts By Keywords
id: 65354b83-a2ea-4ea6-8414-3ab38be0d409
status: experimental
description: Detects XSS that use GET requests by keyword searches in URL strings
author: Saw Win Naung
date: 2021/08/15
logsource:
  category: webserver
detection:
  keywords:
    - '=cookie'
    - '=script'
    - '=onload'
    - '=onmouseover'
  condition: keywords
fields:
  - client_ip
  - vhost
  - url
  - response
falsepositives:
  - Java scripts,CSS Files and PNG files
  - User searches in search boxes of the respective website
level: high

windows

builtin

application

applocker

bits_client

code_integrity

dns_server

driverframeworks

firewall_as

ldap

msexchange

ntlm

printservice

security

servicebus

smbclient

system

🙋‍♀️🙋‍♀️🙋‍♀️APT🙋‍♀️🙋‍♀️🙋‍♀️

Turla Service Install

title: Turla Service Install
id: 1df8b3da-b0ac-4d8a-b7c7-6cb7c24160e4
status: test
description: This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET
author: Florian Roth
references:
  - https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/
date: 2017/03/31
modified: 2021/11/30
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
    ServiceName:
      - 'srservice'
      - 'ipvpn'
      - 'hkmsvc'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.persistence
  - attack.g0010
  - attack.t1543.003

Chafer Activity

title: Chafer Activity
id: 53ba33fd-3a50-4468-a5ef-c583635cfa92
description: Detects Chafer activity attributed to OilRig as reported in Nyotron report in March 2018
status: experimental
references:
    - https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/
tags:
    - attack.persistence
    - attack.g0049
    - attack.t1053.005
    - attack.s0111
    - attack.t1543.003
    - attack.defense_evasion
    - attack.t1112
    - attack.command_and_control
    - attack.t1071.004
date: 2018/03/23
modified: 2021/11/30
author: Florian Roth, Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
logsource:
    product: windows
    service: system
detection:
    selection_service:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        ServiceName:
            - 'SC Scheduled Scan'
            - 'UpdatMachine'
    condition: selection_service
falsepositives:
    - Unknown
level: critical

StoneDrill Service Install

title: StoneDrill Service Install
id: 9e987c6c-4c1e-40d8-bd85-dd26fba8fdd6
status: test
description: This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky
author: Florian Roth
references:
  - https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/
date: 2017/03/07
modified: 2021/11/30
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
    ServiceName: NtsSrv
    ServiceFileName|endswith: ' LocalService'
  condition: selection
falsepositives:
  - Unlikely
level: high
tags:
  - attack.persistence
  - attack.g0064
  - attack.t1543.003

Turla PNG Dropper Service

title: Turla PNG Dropper Service
id: 1228f8e2-7e79-4dea-b0ad-c91f1d5016c1
status: test
description: This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018
author: Florian Roth
references:
  - https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/
date: 2018/11/23
modified: 2021/11/30
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
    ServiceName: 'WerFaultSvc'
  condition: selection
falsepositives:
  - unlikely
level: critical
tags:
  - attack.persistence
  - attack.g0010
  - attack.t1543.003

CobaltStrike Service Installations

title: CobaltStrike Service Installations
id: 5a105d34-05fc-401e-8553-272b45c1522d
description: Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
status: experimental
author: Florian Roth, Wojciech Lesicki
references:
    - https://www.sans.org/webcasts/119395
    - https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
    - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
date: 2021/05/26
modified: 2021/09/30
tags:
    - attack.execution
    - attack.privilege_escalation
    - attack.lateral_movement 
    - attack.t1021.002
    - attack.t1543.003
    - attack.t1569.002
logsource:
    product: windows
    service: system
detection:
    selection_id:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection1:
        ImagePath|contains|all: 
            - 'ADMIN$'
            - '.exe'
    selection2:
        ImagePath|contains|all: 
            - '%COMSPEC%'
            - 'start'
            - 'powershell'
    selection3:
        ImagePath|contains: 'powershell -nop -w hidden -encodedcommand'
    selection4:
        ImagePath|base64offset|contains: "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:"
    condition: selection_id and (selection1 or selection2 or selection3 or selection4)
falsepositives:
    - Unknown
level: critical

Moriya Rootkit

title: Moriya Rootkit
id: 25b9c01c-350d-4b95-bed1-836d04a4f324
description: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report
status: experimental
author: Bhabesh Raj
date: 2021/05/06
modified: 2021/11/30
references:
    - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831
tags:
    - attack.persistence
    - attack.privilege_escalation
    - attack.t1543.003
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        ServiceName: ZzNetSvc
    condition: selection
level: critical
falsepositives:
    - None

taskscheduler

Rare Scheduled Task Creations

title: Rare Scheduled Task Creations
id: b20f6158-9438-41be-83da-a5a16ac90c2b
status: test
description: This rule detects rare scheduled task creations. Typically software gets installed on multiple systems and not only on a few. The aggregation and count function selects tasks with rare names.
author: Florian Roth
date: 2017/03/17
modified: 2021/12/28
logsource:
  product: windows
  service: taskscheduler
detection:
  selection:
    EventID: 106
  filter1:
    TaskName: 
      - \Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan
  timeframe: 7d
  condition: selection and not 1 of filter* | count() by TaskName < 5
falsepositives:
  - Software installation
level: low
tags:
  - attack.persistence
  - attack.s0111
  - attack.t1053.005

windefend

wmi

Mimikatz Use

title: Mimikatz Use
id: 06d71506-7beb-4f22-8888-e2e5e2ca7fd8
description: This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
status: experimental
author: Florian Roth (rule), David ANDRE (additional keywords)
date: 2017/01/10
modified: 2022/01/05
references:
    - https://tools.thehacker.recipes/mimikatz/modules
tags:
    - attack.s0002
    - attack.lateral_movement
    - attack.credential_access
    - car.2013-07-001
    - car.2019-04-004
    - attack.t1003.002
    - attack.t1003.004
    - attack.t1003.001
    - attack.t1003.006
logsource:
    product: windows
detection:
    keywords:
        - 'dpapi::masterkey'
        - 'eo.oe.kiwi'
        - 'event::clear'
        - 'event::drop'
        - 'gentilkiwi.com'
        - 'kerberos::golden'
        - 'kerberos::ptc'
        - 'kerberos::ptt'
        - 'kerberos::tgt'
        - 'Kiwi Legit Printer'
        - 'lsadump::'
        - 'mimidrv.sys'
        - '\mimilib.dll'
        - 'misc::printnightmare'
        - 'misc::shadowcopies'
        - 'misc::skeleton'
        - 'privilege::backup'
        - 'privilege::debug'
        - 'privilege::driver'
        - 'sekurlsa::'
    filter:
        EventID: 15  # Sysmon's FileStream Events (could cause false positives when Sigma rules get copied on/to a system)
    condition: keywords and not filter
falsepositives:
    - Naughty administrators
    - Penetration test
    - AV Signature updates
    - Files with Mimikatz in their filename
level: critical

create_remote_thread

CobaltStrike Process Injection

title: CobaltStrike Process Injection
id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42
description: Detects a possible remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
references:
    - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
    - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/
tags:
    - attack.defense_evasion
    - attack.t1055.001
status: experimental
author: Olaf Hartong, Florian Roth, Aleksey Potapov, oscd.community
date: 2018/11/30
modified: 2021/11/20
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        StartAddress|endswith: 
            - '0B80'
            - '0C7C'
            - '0C88'
    condition: selection
falsepositives:
    - unknown
level: high

CreateRemoteThread API and LoadLibrary

title: CreateRemoteThread API and LoadLibrary
id: 052ec6f6-1adc-41e6-907a-f1c813478bee
status: test
description: Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process
author: Roberto Rodriguez @Cyb3rWard0g
references:
  - https://threathunterplaybook.com/notebooks/windows/05_defense_evasion/WIN-180719170510.html
date: 2019/08/11
modified: 2021/11/27
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    StartModule|endswith: '\kernel32.dll'
    StartFunction: 'LoadLibraryA'
  condition: selection
falsepositives:
  - Unknown
level: critical
tags:
  - attack.defense_evasion
  - attack.t1055.001

Accessing WinAPI in PowerShell. Code Injection.

title: Accessing WinAPI in PowerShell. Code Injection.
id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50
status: test
description: Detecting Code injection with PowerShell in another process
author: Nikita Nazarov, oscd.community
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
date: 2020/10/06
modified: 2021/11/27
logsource:
  product: windows
  category: create_remote_thread
  definition: 'Note that you have to configure logging for CreateRemoteThread in Symson config'
detection:
  selection:
    SourceImage|endswith: '\powershell.exe'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.execution
  - attack.t1059.001

PowerShell Rundll32 Remote Thread Creation

title: PowerShell Rundll32 Remote Thread Creation
id: 99b97608-3e21-4bfe-8217-2a127c396a0e
status: experimental
description: Detects PowerShell remote thread creation in Rundll32.exe
author: Florian Roth
references:
    - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html
date: 2018/06/25
modified: 2021/11/12
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        SourceImage|endswith: '\powershell.exe'
        TargetImage|endswith: '\rundll32.exe'
    condition: selection
tags:
    - attack.defense_evasion
    - attack.execution
    - attack.t1218.011
    - attack.t1059.001
falsepositives:
    - Unknown
level: high

Suspicious Remote Thread Created

title: Suspicious Remote Thread Created
id: 66d31e5f-52d6-40a4-9615-002d3789a119
description: Offensive tradecraft is switching away from using APIs like "CreateRemoteThread", however, this is still largely observed in the wild. This rule aims
    to detect suspicious processes (those we would not expect to behave in this way like word.exe or outlook.exe) creating remote threads on other processes. It is
    a generalistic rule, but it should have a low FP ratio due to the selected range of processes.
notes:
    - MonitoringHost.exe is a process that loads .NET CLR by default and thus a favorite for process injection for .NET in-memory offensive tools.
status: experimental
date: 2019/10/27
modified: 2021/06/27
author: Perez Diego (@darkquassar), oscd.community
references:
    - Personal research, statistical analysis
    - https://lolbas-project.github.io
logsource:
    product: windows
    category: create_remote_thread
tags:
    - attack.privilege_escalation
    - attack.defense_evasion
    - attack.t1055
detection:
    selection: 
        SourceImage|endswith:
            - '\bash.exe'
            - '\cvtres.exe'
            - '\defrag.exe'
            - '\dnx.exe'
            - '\esentutl.exe'
            - '\excel.exe'
            - '\expand.exe'
            - '\explorer.exe'
            - '\find.exe'
            - '\findstr.exe'
            - '\forfiles.exe'
            - '\git.exe'
            - '\gpupdate.exe'
            - '\hh.exe'
            - '\iexplore.exe'
            - '\installutil.exe'
            - '\lync.exe'
            - '\makecab.exe'
            - '\mDNSResponder.exe'
            - '\monitoringhost.exe'
            - '\msbuild.exe'
            - '\mshta.exe'
            - '\msiexec.exe'
            - '\mspaint.exe'
            - '\outlook.exe'
            - '\ping.exe'
            - '\powerpnt.exe'
            - '\powershell.exe'
            - '\provtool.exe'
            - '\python.exe'
            - '\regsvr32.exe'
            - '\robocopy.exe'
            - '\runonce.exe'
            - '\sapcimc.exe'
            - '\schtasks.exe'
            - '\smartscreen.exe'
            - '\spoolsv.exe'
            # - '\taskhost.exe'  # disabled due to false positives
            - '\tstheme.exe'
            - '\userinit.exe'
            - '\vssadmin.exe'
            - '\vssvc.exe'
            - '\w3wp.exe'       
            - '\winlogon.exe'
            - '\winscp.exe'
            - '\wmic.exe'
            - '\word.exe'
            - '\wscript.exe'
    filter:
        SourceImage|contains: 'Visual Studio'
    condition: selection and not filter
fields:
    - ComputerName
    - User
    - SourceImage
    - TargetImage
level: high
falsepositives:
    - Unknown

Password Dumper Remote Thread in LSASS

title: Password Dumper Remote Thread in LSASS
id: f239b326-2f41-4d6b-9dfa-c846a60ef505
description: Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.
references:
    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm
status: stable
author: Thomas Patzke
date: 2017/02/19
modified: 2021/06/21
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        StartModule: ''
    condition: selection
tags:
    - attack.credential_access
    - attack.s0005
    - attack.t1003.001
falsepositives:
    - Antivirus products
level: high

CACTUSTORCH Remote Thread Creation

title: CACTUSTORCH Remote Thread Creation
id: 2e4e488a-6164-4811-9ea1-f960c7359c40
description: Detects remote thread creation from CACTUSTORCH as described in references.
references:
    - https://twitter.com/SBousseaden/status/1090588499517079552
    - https://github.com/mdsecactivebreach/CACTUSTORCH
status: experimental
author: '@SBousseaden (detection), Thomas Patzke (rule)'
date: 2019/02/01
modified: 2021/11/12
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        SourceImage|endswith:
            - '\System32\cscript.exe'
            - '\System32\wscript.exe'
            - '\System32\mshta.exe'
            - '\winword.exe'
            - '\excel.exe'
        TargetImage|contains: '\SysWOW64\'
        StartModule: null
    condition: selection
tags:
    - attack.defense_evasion
    - attack.t1055.012
    - attack.execution
    - attack.t1059.005
    - attack.t1059.007
    - attack.t1218.005
falsepositives:
    - unknown
level: high

file_event

Startup Folder File Write

title: Startup Folder File Write
id: 2aa0a6b4-a865-495b-ab51-c28249537b75
status: test
description: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
references:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/12
  - https://threathunterplaybook.com/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.html
date: 2020/05/02
modified: 2021/11/27
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: 'ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp'
  condition: selection
falsepositives:
  - unknown
level: low
tags:
  - attack.persistence
  - attack.t1547.001

PowerShell Writing Startup Shortcuts

title: PowerShell Writing Startup Shortcuts
id: 92fa78e7-4d39-45f1-91a3-8b23f3f1088d
description: Attempts to detect PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"
status: experimental
references: 
    - https://redcanary.com/blog/intelligence-insights-october-2021/
    - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder
tags:
    - attack.registry_run_keys_/_startup_folder
    - attack.t1547.001
date: 2021/10/24
author: Christopher Peacock '@securepeacock', SCYTHE
level: high
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\powershell.exe'
        TargetFilename|contains: '\start menu\programs\startup\'
        TargetFilename|endswith: '.lnk'
    condition: selection
falsepositives:
    - Unknown
    - Depending on your environment accepted applications may leverage this at times. It is recomended to search for anomolies inidicative of malware.

Moriya Rootkit

title: Moriya Rootkit
id: a1507d71-0b60-44f6-b17c-bf53220fdd88
related:
    - id: 25b9c01c-350d-4b95-bed1-836d04a4f324
      type: derived
description: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report
status: experimental
author: Bhabesh Raj
date: 2021/05/06
modified: 2021/09/21
references:
    - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831
tags:
    - attack.persistence
    - attack.privilege_escalation
    - attack.t1543.003
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename: 'C:\Windows\System32\drivers\MoriyaStreamWatchmen.sys'
    condition: selection
level: critical
falsepositives:
    - None

Dump Office Macro Files from Commandline

title: Dump Office Macro Files from Commandline
id: b1c50487-1967-4315-a026-6491686d860e
status: experimental
description: A office file with macro is created from a commandline or a script
author: frack113
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1566.001/T1566.001.md
    - https://docs.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
date: 2022/01/23
logsource:
    category: file_event
    product: windows
detection:
    selection_ext: 
        TargetFilename|endswith:
            - .docm
            - .dotm
            - .xlsm
            - .xltm
            - .potm 
            - .pptm
            - .pptx 
    selection_cmd:
        - Image|endswith:
            - \cmd.exe
            - \powershell.exe
        - ParentImage|endswith:
            - \cmd.exe
            - \powershell.exe
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
tags:
    - attack.initial_access
    - attack.t1566.001

image_load

network_connection

pipe_created

pipe_created_alternate_powershell_hosts_pipe.yml
pipe_created_apt_turla_namedpipes.yml
pipe_created_cred_dump_tools_named_pipes.yml
pipe_created_efspotato_namedpipe.yml
pipe_created_mal_cobaltstrike.yml
pipe_created_mal_cobaltstrike_re.yml
pipe_created_mal_namedpipes.yml
pipe_created_powershell_execution_pipe.yml
pipe_created_psexec_pipes_artifacts.yml
pipe_created_susp_adfs_namedpipe_connection.yml
pipe_created_susp_cobaltstrike_pipe_patterns.yml
pipe_created_susp_wmi_consumer_namedpipe.yml
pipe_created_tool_psexec.yml

powershell

powershell_classic

posh_pc_alternate_powershell_hosts.yml
posh_pc_delete_volume_shadow_copies.yml
posh_pc_downgrade_attack.yml
posh_pc_exe_calling_ps.yml
posh_pc_powercat.yml
posh_pc_remote_powershell_session.yml
posh_pc_renamed_powershell.yml
posh_pc_susp_athremotefxvgpudisablementcommand.yml
posh_pc_susp_get_nettcpconnection.yml
posh_pc_susp_zip_compress.yml
posh_pc_suspicious_download.yml
posh_pc_tamper_with_windows_defender.yml
posh_pc_wsman_com_provider_no_powershell.yml
posh_pc_xor_commandline.yml

powershell_module

powershell_script

PowerShell ShellCode Base64ed

AAAAYInlM
OiCAAAAYInlM
OiJAAAAYInlM

原始数据是啥呀？&input=QUFBQVlJbmxNCk9pQ0FBQUFZSW5sTQpPaUpBQUFBWUlubE0)

title: PowerShell ShellCode
id: 16b37b70-6fcf-4814-a092-c36bd3aafcbd
status: experimental
description: Detects Base64 encoded Shellcode
references:
    - https://twitter.com/cyb3rops/status/1063072865992523776
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - attack.t1055
    - attack.execution
    - attack.t1059.001
author: David Ledbetter (shellcode), Florian Roth (rule)
date: 2018/11/17
modified: 2021/10/16
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection:
        ScriptBlockText|contains: 'AAAAYInlM'
    selection2:
        ScriptBlockText|contains:
            - 'OiCAAAAYInlM'
            - 'OiJAAAAYInlM'
    condition: selection and selection2
falsepositives:
    - Unknown
level: critical

Obfuscation

Invoke-Obfuscation CLIP+Launcher

title: Invoke-Obfuscation CLIP+ Launcher
id: 73e67340-0d25-11eb-adc1-0242ac120002
description: Detects Obfuscated use of Clip.exe to execute PowerShell
status: experimental
author: Jonathan Cheong, oscd.community
date: 2020/10/13
modified: 2021/10/16
references:
     - https://github.com/Neo23x0/sigma/issues/1009 #(Task 26)
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_4104:
        ScriptBlockText|re: '.*cmd.{0,5}(?:\/c|\/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\\"\{\d\}.+\-f.+\"'
    condition: selection_4104
falsepositives:
    - Unknown
level: high

Invoke-Obfuscation Obfuscated IEXInvocation

title: Invoke-Obfuscation Obfuscated IEX Invocation
id: 1b9dc62e-6e9e-42a3-8990-94d7a10007f7
description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014
references:
  - https://github.com/danielbohannon/Invoke-Obfuscation/blob/master/Out-ObfuscatedStringCommand.ps1#L873-L888
status: experimental
author: 'Daniel Bohannon (@Mandiant/@FireEye), oscd.community'
date: 2019/11/08
modified: 2022/01/27
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_iex:
        - ScriptBlockText|re: '\$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\['
        - ScriptBlockText|re: '\$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\['
        - ScriptBlockText|re: '\$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\['
        - ScriptBlockText|re: '\$env:ComSpec\[(\s*\d{1,3}\s*,){2}'
        - ScriptBlockText|re: '\\\\*mdr\\\\*\W\s*\)\.Name'
        - ScriptBlockText|re: '\$VerbosePreference\.ToString\('
    condition: selection_iex
falsepositives:
    - Unknown
level: high

Invoke-Obfuscation STDIN+Launcher

title: Invoke-Obfuscation STDIN+Launcher
id: 779c8c12-0eb1-11eb-adc1-0242ac120002
description: Detects Obfuscated use of stdin to execute PowerShell
status: experimental
author: Jonathan Cheong, oscd.community
date: 2020/10/15
modified: 2021/10/16
references:
     - https://github.com/Neo23x0/sigma/issues/1009 #(Task 25)
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_4104:
        ScriptBlockText|re: '.*cmd.{0,5}(?:\/c|\/r).+powershell.+(?:\$\{?input\}?|noexit).+\"'
    condition: selection_4104
falsepositives:
    - Unknown
level: high

Invoke-Obfuscation VAR+ Launcher


title: Invoke-Obfuscation VAR+ Launcher
id: 0adfbc14-0ed1-11eb-adc1-0242ac120002
description: Detects Obfuscated use of Environment Variables to execute PowerShell
status: experimental
author: Jonathan Cheong, oscd.community
date: 2020/10/15
modified: 2021/10/16
references:
     - https://github.com/Neo23x0/sigma/issues/1009 #(Task 24)
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_4104:
        ScriptBlockText|re: '.*cmd.{0,5}(?:\/c|\/r)(?:\s|)\"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\\"\s+?\-f(?:.*\)){1,}.*\"'
    condition: selection_4104
falsepositives:
    - Unknown
level: high

Invoke-Obfuscation COMPRESS OBFUSCATION

title: Invoke-Obfuscation COMPRESS OBFUSCATION
id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07
description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION
status: experimental
author: Timur Zinniatullin, oscd.community
date: 2020/10/18
modified: 2021/10/16
references:
    - https://github.com/Neo23x0/sigma/issues/1009 #(Task 19)
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_4104:
        ScriptBlockText|re: '(?i).*new-object.*(?:system\.io\.compression\.deflatestream|system\.io\.streamreader).*text\.encoding\]::ascii.*readtoend'
    condition: selection_4104
falsepositives:
    - unknown
level: medium

Invoke-Obfuscation RUNDLL LAUNCHER

title: Invoke-Obfuscation RUNDLL LAUNCHER
id: e6cb92b4-b470-4eb8-8a9d-d63e8583aae0
description: Detects Obfuscated Powershell via RUNDLL LAUNCHER
status: experimental
author: Timur Zinniatullin, oscd.community
date: 2020/10/18
modified: 2021/10/16
references:
    - https://github.com/Neo23x0/sigma/issues/1009 #(Task 23)
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_4104:
        ScriptBlockText|re: '(?i).*rundll32(?:\.exe)?(?:\s+)?shell32\.dll.*shellexec_rundll.*powershell.*\"'
    condition: selection_4104
falsepositives:
    - Unknown
level: medium

Invoke-Obfuscation Via Stdin

title: Invoke-Obfuscation Via Stdin
id: 86b896ba-ffa1-4fea-83e3-ee28a4c915c7
description: Detects Obfuscated Powershell via Stdin in Scripts
status: experimental
author: Nikita Nazarov, oscd.community
date: 2020/10/12
modified: 2021/10/16
references:
     - https://github.com/Neo23x0/sigma/issues/1009 #(Task28)
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_4104:
        ScriptBlockText|re: '(?i).*(set).*&&\s?set.*(environment|invoke|\${?input).*&&.*"'
    condition: selection_4104
falsepositives:
    - Unknown
level: high

Invoke-Obfuscation Via Use Clip

title: Invoke-Obfuscation Via Use Clip
id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0
description: Detects Obfuscated Powershell via use Clip.exe in Scripts
status: experimental
author: Nikita Nazarov, oscd.community
date: 2020/10/09
modified: 2021/10/16
references:
     - https://github.com/Neo23x0/sigma/issues/1009 #(Task29)
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_4104:
        ScriptBlockText|re: '(?i).*?echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?).*'
    condition: selection_4104
falsepositives:
    - Unknown
level: high

Invoke-Obfuscation Via Use MSHTA


title: Invoke-Obfuscation Via Use MSHTA
id: e55a5195-4724-480e-a77e-3ebe64bd3759
description: Detects Obfuscated Powershell via use MSHTA in Scripts
status: experimental
author: Nikita Nazarov, oscd.community
date: 2020/10/08
modified: 2021/10/16
references:
    - https://github.com/Neo23x0/sigma/issues/1009 #(Task31)
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_4104:
        ScriptBlockText|re: '(?i).*(set).*(&&).*(mshta).*(vbscript:createobject).*(\.run).*\(window\.close\).*"'
    condition: selection_4104
falsepositives:
    - Unknown
level: high

Invoke-Obfuscation Via Use Rundll32

title: Invoke-Obfuscation Via Use Rundll32
id: a5a30a6e-75ca-4233-8b8c-42e0f2037d3b
description: Detects Obfuscated Powershell via use Rundll32 in Scripts
status: experimental
author: Nikita Nazarov, oscd.community
date: 2019/10/08
modified: 2021/10/16
references:
    - https://github.com/Neo23x0/sigma/issues/1009
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_4104:
        ScriptBlockText|re: '(?i).*&&.*rundll32.*shell32\.dll.*shellexec_rundll.*(value|invoke|comspec|iex).*"'
    condition: selection_4104
falsepositives:
    - Unknown
level: high

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
id: e54f5149-6ba3-49cf-b153-070d24679126
description: Detects Obfuscated Powershell via VAR++ LAUNCHER
status: experimental
author: Timur Zinniatullin, oscd.community
date: 2020/10/13
modified: 2021/10/16
references:
    - https://github.com/Neo23x0/sigma/issues/1009 #(Task27)
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection_4104:
        ScriptBlockText|re: '(?i).*&&set.*(\{\d\}){2,}\\\"\s+?\-f.*&&.*cmd.*\/c' # FPs with |\/r
    condition: selection_4104
falsepositives:
    - Unknown
level: high

process_access

process_creation

APT

proc_creation_win_apt_actinium_persistence.yml

title: Scheduled Task WScript VBScript
id: e1118a8f-82f5-44b3-bb6b-8a284e5df602
status: experimental
description: Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.
author: Andreas Hunkeler (@Karneades)
references:
  - https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations
date: 2022/02/07
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - 'schtasks'
      - 'create'
      - 'wscript'
      - 'e:vbscript'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Unlikely
level: high

proc_creation_win_apt_apt29_thinktanks.yml


title: APT29
id: 033fe7d6-66d1-4240-ac6b-28908009c71f
status: test
description: This method detects a suspicious PowerShell command line combination as used by APT29 in a campaign against U.S. think tanks.
author: Florian Roth
references:
  - https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
  - https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html
date: 2018/12/04
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - '-noni'
      - '-ep'
      - 'bypass'
      - '$'
  condition: selection
falsepositives:
  - unknown
level: critical
tags:
  - attack.execution
  - attack.g0016
  - attack.t1059.001

proc_creation_win_apt_babyshark.yml

title: Baby Shark Activity
id: 2b30fa36-3a18-402f-a22d-bf4ce2189f35
status: test
description: Detects activity that could be related to Baby Shark malware
author: Florian Roth
references:
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
date: 2019/02/24
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine:
      - reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default"
      - powershell.exe mshta.exe http*
      - cmd.exe /c taskkill /im cmd.exe
  condition: selection
falsepositives:
  - unknown
level: high
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
  - attack.discovery
  - attack.t1012
  - attack.defense_evasion
  - attack.t1218.005

proc_creation_win_apt_bear_activity_gtr19.yml

title: Judgement Panda Credential Access Activity
id: b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee
status: test
description: Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike
author: Florian Roth
references:
  - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
date: 2019/02/21
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    Image|endswith: '\xcopy.exe'
    CommandLine|contains|all:
      - '/S'
      - '/E'
      - '/C'
      - '/Q'
      - '/H'
      - '\\'
  selection2:
    Image|endswith: '\adexplorer.exe'
    CommandLine|contains|all:
      - '-snapshot'
      - '""'
      - 'c:\users\'
  condition: selection1 or selection2
falsepositives:
  - unknown
level: critical
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1003.003

proc_creation_win_apt_bluemashroom.yml

title: BlueMashroom DLL Load
id: bd70d3f8-e60e-4d25-89f0-0b5a9cff20e0
status: test
description: Detects a suspicious DLL loading from AppData Local path as described in BlueMashroom report
author: Florian Roth, Tim Shelton
references:
  - https://www.virusbulletin.com/conference/vb2019/abstracts/apt-cases-exploiting-vulnerabilities-region-specific-software
date: 2019/10/02
modified: 2022/03/02
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains|all:
      - '\regsvr32'
      - '\AppData\Local\'
    - CommandLine|contains|all:
      - '\AppData\Local\'
      - ',DllEntry'
  filter_1:
    - CommandLine|contains: 'AppData\Local\Microsoft\TeamsMeetingAddin\'
    - CommandLine|endswith:
      - '\x86\Microsoft.Teams.AddinLoader.dll'
      - '\x86\Microsoft.Teams.AddinLoader.dll"'
      - '\x64\Microsoft.Teams.AddinLoader.dll'
      - '\x64\Microsoft.Teams.AddinLoader.dll"'
  condition: selection and not 1 of filter*
falsepositives:
  - Unlikely
level: critical
tags:
  - attack.defense_evasion
  - attack.t1218.010

proc_creation_win_apt_chafer_mar18.yml

title: Chafer Activity
id: ce6e34ca-966d-41c9-8d93-5b06c8b97a06
related:
    - id: 53ba33fd-3a50-4468-a5ef-c583635cfa92
      type: derived
description: Detects Chafer activity attributed to OilRig as reported in Nyotron report in March 2018
status: experimental
references:
    - https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/
tags:
    - attack.persistence
    - attack.g0049
    - attack.t1053.005
    - attack.s0111
    - attack.t1543.003
    - attack.defense_evasion
    - attack.t1112
    - attack.command_and_control
    - attack.t1071.004
date: 2018/03/23
modified: 2021/09/19
author: Florian Roth, Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
logsource:
    category: process_creation
    product: windows
detection:
    selection_process0:
        CommandLine|contains: '\Service.exe'
        CommandLine|endswith: 
            - 'i'
            - 'u'
    selection_process1:
        - CommandLine|endswith: '\microsoft\Taskbar\autoit3.exe'
        - CommandLine|startswith: 'C:\wsc.exe'
    selection_process2:
        Image|contains: '\Windows\Temp\DB\'
        Image|endswith: '.exe'
    selection_process3:
        CommandLine|contains|all: 
            - '\nslookup.exe'
            - '-q=TXT'
        ParentImage|contains: '\Autoit'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: critical

proc_creation_win_apt_cloudhopper.yml

title: WMIExec VBS Script
id: 966e4016-627f-44f7-8341-f394905c361f
status: test
description: Detects suspicious file execution by wscript and cscript
author: Florian Roth
references:
  - https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
date: 2017/04/07
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\cscript.exe'
    CommandLine|contains|all:
      - '.vbs'
      - '/shell'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Unlikely
level: critical
tags:
  - attack.execution
  - attack.g0045
  - attack.t1059.005

proc_creation_win_apt_dragonfly.yml


title: CrackMapExecWin
id: 04d9079e-3905-4b70-ad37-6bdf11304965
status: test
description: Detects CrackMapExecWin Activity as Described by NCSC
author: Markus Neis
references:
  - https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control
  - https://attack.mitre.org/software/S0488/
date: 2018/04/08
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\crackmapexec.exe'
  condition: selection
falsepositives:
  - None
level: critical
tags:
  - attack.g0035
  - attack.credential_access
  - attack.discovery
  - attack.t1110
  - attack.t1087

proc_creation_win_apt_elise.yml

title: Elise Backdoor
id: e507feb7-5f73-4ef6-a970-91bb6f6d744f
status: test
description: Detects Elise backdoor acitivty as used by APT32
author: Florian Roth
references:
  - https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting
date: 2018/01/31
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    Image: 'C:\Windows\SysWOW64\cmd.exe'
    CommandLine|contains: '\Windows\Caches\NavShExt.dll '
  selection2:
    CommandLine|endswith: '\AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll,Setting'
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
tags:
  - attack.g0030
  - attack.g0050
  - attack.s0081
  - attack.execution
  - attack.t1059.003

proc_creation_win_apt_emissarypanda_sep19.yml

title: Emissary Panda Malware SLLauncher
id: 9aa01d62-7667-4d3b-acb8-8cb5103e2014
status: test
description: Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
author: Florian Roth
references:
  - https://app.any.run/tasks/579e7587-f09d-4aae-8b07-472833262965
  - https://twitter.com/cyb3rops/status/1168863899531132929
date: 2018/09/03
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\sllauncher.exe'
    Image|endswith: '\svchost.exe'
  condition: selection
falsepositives:
  - Unknown
level: critical
tags:
  - attack.defense_evasion
  - attack.t1574.002

proc_creation_win_apt_empiremonkey.yml

title: Empire Monkey
id: 10152a7b-b566-438f-a33c-390b607d1c8d
status: test
description: Detects EmpireMonkey APT reported Activity
author: Markus Neis
references:
  - https://app.any.run/tasks/a4107649-8cb0-41af-ad75-113152d4d57b
date: 2019/04/02
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection_cutil:
    CommandLine|endswith: '/i:%APPDATA%\logs.txt scrobj.dll'
    Image|endswith: '\cutil.exe'
  selection_regsvr32:
    CommandLine|endswith: '/i:%APPDATA%\logs.txt scrobj.dll'
    Description: 'Microsoft(C) Registerserver'
  condition: 1 of selection*
falsepositives:
  - Very Unlikely
level: critical
tags:
  - attack.defense_evasion
  - attack.t1218.010

proc_creation_win_apt_equtiongroup_dll_u_load.yml

title: Equation Group DLL_U Load
id: d465d1d8-27a2-4cca-9621-a800f37cf72e
status: test
description: Detects a specific tool and export used by EquationGroup
author: Florian Roth
references:
  - https://github.com/adamcaudill/EquationGroupLeak/search?utf8=%E2%9C%93&q=dll_u&type=
  - https://securelist.com/apt-slingshot/84312/
  - https://twitter.com/cyb3rops/status/972186477512839170
date: 2019/03/04
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    Image|endswith: '\rundll32.exe'
    CommandLine|endswith: ',dll_u'
  selection2:
    CommandLine|contains: ' -export dll_u '
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
tags:
  - attack.g0020
  - attack.defense_evasion
  - attack.t1218.011

proc_creation_win_apt_evilnum_jul20.yml


title: EvilNum Golden Chickens Deployment via OCX Files
id: 8acf3cfa-1e8c-4099-83de-a0c4038e18f0
status: test
description: Detects Golden Chickens deployment method as used by Evilnum in report published in July 2020
author: Florian Roth
references:
  - https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/
  - https://app.any.run/tasks/33d37fdf-158d-4930-aa68-813e1d5eb8ba/
date: 2020/07/10
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - 'regsvr32'
      - '/s'
      - '/i'
      - '\AppData\Roaming\'
      - '.ocx'
  condition: selection
falsepositives:
  - Unknown
level: critical
tags:
  - attack.defense_evasion
  - attack.t1218.011

proc_creation_win_apt_gallium.yml

title: GALLIUM Artefacts
id: 18739897-21b1-41da-8ee4-5b786915a676
related:
    - id: 440a56bf-7873-4439-940a-1c8a671073c2
      type: derived
status: experimental
description: Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.
author: Tim Burrell
date: 2020/02/07
modified: 2021/09/19
references:
    - https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800669(v=ws.11)
tags:
    - attack.credential_access
    - attack.t1212 
    - attack.command_and_control
    - attack.t1071
logsource:
    product: windows
    category: process_creation
detection:
    legitimate_process_path:
        Image|contains:
            - ':\Program Files(x86)\'
            - ':\Program Files\'
    legitimate_executable:
        sha1:
            - 'e570585edc69f9074cb5e8a790708336bd45ca0f'
    condition: legitimate_executable and not legitimate_process_path
falsepositives:
    - unknown
level: high

proc_creation_win_apt_gallium_sha1.yml

title: GALLIUM Artefacts
id: 440a56bf-7873-4439-940a-1c8a671073c2
status: experimental
description: Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.
author: Tim Burrell
date: 2020/02/07
modified: 2021/09/19
references:
    - https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800669(v=ws.11)
tags:
    - attack.credential_access
    - attack.t1212 
    - attack.command_and_control
    - attack.t1071
logsource:
    product: windows
    category: process_creation
detection:
    exec_selection:
        sha1:
            - '53a44c2396d15c3a03723fa5e5db54cafd527635'
            - '9c5e496921e3bc882dc40694f1dcc3746a75db19'
            - 'aeb573accfd95758550cf30bf04f389a92922844'
            - '79ef78a797403a4ed1a616c68e07fff868a8650a'
            - '4f6f38b4cec35e895d91c052b1f5a83d665c2196'
            - '1e8c2cac2e4ce7cbd33c3858eb2e24531cb8a84d'
            - 'e841a63e47361a572db9a7334af459ddca11347a'
            - 'c28f606df28a9bc8df75a4d5e5837fc5522dd34d'
            - '2e94b305d6812a9f96e6781c888e48c7fb157b6b'
            - 'dd44133716b8a241957b912fa6a02efde3ce3025'
            - '8793bf166cb89eb55f0593404e4e933ab605e803'
            - 'a39b57032dbb2335499a51e13470a7cd5d86b138'
            - '41cc2b15c662bc001c0eb92f6cc222934f0beeea'
            - 'd209430d6af54792371174e70e27dd11d3def7a7'
            - '1c6452026c56efd2c94cea7e0f671eb55515edb0'
            - 'c6b41d3afdcdcaf9f442bbe772f5da871801fd5a'
            - '4923d460e22fbbf165bbbaba168e5a46b8157d9f'
            - 'f201504bd96e81d0d350c3a8332593ee1c9e09de'
            - 'ddd2db1127632a2a52943a2fe516a2e7d05d70d2'
    condition: exec_selection
falsepositives:
    - unknown
level: high

proc_creation_win_apt_greenbug_may20.yml

title: Greenbug Campaign Indicators
id: 3711eee4-a808-4849-8a14-faf733da3612
status: experimental
description: Detects tools and process executions as observed in a Greenbug campaign in May 2020
references:
    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia
author: Florian Roth
date: 2020/05/20
modified: 2021/09/21
tags:
    - attack.g0049
    - attack.execution
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1105
    - attack.defense_evasion
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains|all: 
            - 'bitsadmin'
            - '/transfer'
            - 'CSIDL_APPDATA'
    selection2:
        CommandLine|contains: 
            - 'CSIDL_SYSTEM_DRIVE'
    selection3: 
        CommandLine|contains:
            - '\msf.ps1'
            - '8989 -e cmd.exe'
            - 'system.Data.SqlClient.SqlDataAdapter($cmd); [void]$da.fill'
            - '-nop -w hidden -c $k=new-object'
            - '[Net.CredentialCache]::DefaultCredentials;IEX '
            - ' -nop -w hidden -c $m=new-object net.webclient;$m'
            - '-noninteractive -executionpolicy bypass whoami'
            - '-noninteractive -executionpolicy bypass netstat -a'
            - 'L3NlcnZlcj1'  # base64 encoded '/server='
    selection4:
        Image|endswith:
            - '\adobe\Adobe.exe'
            - '\oracle\local.exe'
            - '\revshell.exe'
            - 'infopagesbackup\ncat.exe'
            - 'CSIDL_SYSTEM\cmd.exe'
            - '\programdata\oracle\java.exe'
            - 'CSIDL_COMMON_APPDATA\comms\comms.exe'
            - '\Programdata\VMware\Vmware.exe'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: critical

proc_creation_win_apt_hafnium.yml

title: Exchange Exploitation Activity
id: bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
description: Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
author: Florian Roth
date: 2021/03/09
modified: 2021/03/16
status: experimental
references:
    - https://blog.truesec.com/2021/03/07/exchange-zero-day-proxylogon-and-hafnium/
    - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
    - https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3
    - https://twitter.com/GadixCRK/status/1369313704869834753?s=20
    - https://twitter.com/BleepinComputer/status/1372218235949617161
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains|all:
            - 'attrib'
            - ' +h '
            - ' +s '
            - ' +r '
            - '.aspx'
    selection2:
        CommandLine|contains|all:
            - 'schtasks'
            - 'VSPerfMon'
    selection3:
        CommandLine|contains|all:
            - 'vssadmin list shadows'
            - 'Temp\__output'
    selection4: 
        CommandLine|contains: '%TEMP%\execute.bat'
    selection5:
        Image|endswith: 'Users\Public\opera\Opera_browser.exe'
    selection6:
        Image|endswith: 'Opera_browser.exe'
        ParentImage|endswith:
            - '\services.exe'
            - '\svchost.exe'
    selection7:
        Image|contains: '\ProgramData\VSPerfMon\'
    selection8:
        CommandLine|contains|all:
            - ' -t7z '
            - 'C:\Programdata\pst'
            - '\it.zip'
    selection9:
        Image|endswith: '\makecab.exe'
        CommandLine|contains:
            - 'Microsoft\Exchange Server\'
            - 'inetpub\wwwroot'
    selection10:
        CommandLine|contains: 
            - '\Temp\xx.bat'
            - 'Windows\WwanSvcdcs'
            - 'Windows\Temp\cw.exe'
    selection11: 
        CommandLine|contains|all:
            - '\comsvcs.dll'
            - 'Minidump'
            - '\inetpub\wwwroot'
    selection12:
        CommandLine|contains|all:
            - 'dsquery'
            - ' -uco '
            - '\inetpub\wwwroot'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high
tags:
    - attack.persistence 
    - attack.t1546
    - attack.t1053

proc_creation_win_apt_hurricane_panda.yml

title: Hurricane Panda Activity
id: 0eb2107b-a596-422e-b123-b389d5594ed7
status: test
description: Detects Hurricane Panda Activity
author: Florian Roth
references:
  - https://www.crowdstrike.com/blog/crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-exploit-cve-2014-4113-hurricane-panda/
date: 2019/03/04
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains|all:
      - 'localgroup'
      - 'admin'
      - '/add'
    - CommandLine|contains:
      - '\Win64.exe'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.privilege_escalation
  - attack.g0009
  - attack.t1068

proc_creation_win_apt_judgement_panda_gtr19.yml

title: Judgement Panda Exfil Activity
id: 03e2746e-2b31-42f1-ab7a-eb39365b2422
status: test
description: Detects Judgement Panda activity as described in Global Threat Report 2019 by Crowdstrike
author: Florian Roth
references:
  - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
date: 2019/02/21
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    - CommandLine|endswith: 'eprod.ldf'
    - CommandLine|contains:
      - '\ldifde.exe -f -n '
      - '\7za.exe a 1.7z '
      - '\aaaa\procdump64.exe'
      - '\aaaa\netsess.exe'
      - '\aaaa\7za.exe'
      - 'copy .\1.7z \'
      - 'copy \\client\c$\aaaa\'
  selection2:
    Image: C:\Users\Public\7za.exe
  condition: selection1 or selection2
falsepositives:
  - unknown
level: critical
tags:
  - attack.lateral_movement
  - attack.g0010
  - attack.credential_access
  - attack.t1003.001
  - attack.exfiltration
  - attack.t1560.001

proc_creation_win_apt_ke3chang_regadd.yml

title: Ke3chang Registry Key Modifications
id: 7b544661-69fc-419f-9a59-82ccc328f205
status: test
description: Detects Registry modifications performed by Ke3chang malware in campaigns running in 2019 and 2020
author: Markus Neis, Swisscom
references:
  - https://www.verfassungsschutz.de/embed/broschuere-2020-06-bfv-cyber-brief-2020-01.pdf
  - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
date: 2020/06/18
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
        # Ke3chang and TidePool both modify the IEHarden registry key, as well as the following list of keys. 
        # Setting these registry keys is unique to the Ke3chang and TidePool malware families.
        # HKCU\Software\Microsoft\Internet Explorer\Main\Check_Associations
        # HKCU\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize
        # HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IEharden
    CommandLine|contains:
      - '-Property DWORD -name DisableFirstRunCustomize -value 2 -Force'
      - '-Property String -name Check_Associations -value'
      - '-Property DWORD -name IEHarden -value 0 -Force'
  condition: selection1
falsepositives:
  - Will need to be looked for combinations of those processes
level: critical
tags:
  - attack.g0004
  - attack.defense_evasion
  - attack.t1562.001

proc_creation_wi_apt_lazarus_activity_apr21.yml

title: Lazarus Activity
id: 4a12fa47-c735-4032-a214-6fab5b120670
description: Detects different process creation events as described in Malwarebytes's threat report on Lazarus group activity
status: experimental
references:
    - https://blog.malwarebytes.com/malwarebytes-news/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/
tags:
    - attack.g0032
    - attack.execution
    - attack.t1106 
author: Bhabesh Raj
date: 2021/04/20
modified: 2021/06/27
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains|all:
            - 'mshta'
            - '.zip'
    selection2:
        ParentImage:
            - 'C:\Windows\System32\wbem\wmiprvse.exe'
        Image:
            - 'C:\Windows\System32\mshta.exe'
    selection3:
        ParentImage|contains:
            - ':\Users\Public\'
        Image:
            - 'C:\Windows\System32\rundll32.exe'
    condition: 1 of selection*
falsepositives:
    - Should not be any false positives
level: critical

proc_creation_win_apt_lazarus_activity_dec20.yml

title: Lazarus Activity
id: 24c4d154-05a4-4b99-b57d-9b977472443a
description: Detects different process creation events as described in various threat reports on Lazarus group activity
status: experimental
references:
    - https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/
    - https://www.hvs-consulting.de/lazarus-report/
tags:
    - attack.g0032
    - attack.execution
    - attack.t1059 
author: Florian Roth
date: 2020/12/23
modified: 2021/06/27
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains:
            - 'reg.exe save hklm\sam %temp%\~reg_sam.save'
            - '1q2w3e4r@#$@#$@#$'
            - ' -hp1q2w3e4 '
            - '.dat data03 10000 -p '
    selection2:
        CommandLine|contains|all:
            - 'process call create'
            - ' > %temp%\~'
    selection3:
        CommandLine|contains|all:
            - 'netstat -aon | find '
            - ' > %temp%\~'
    # Network share discovery
    selection4:
        CommandLine|contains:
            - '.255 10 C:\ProgramData\'
    condition: 1 of selection*
falsepositives:
    - Overlap with legitimate process activity in some cases (especially selection 3 and 4)
level: critical

proc_creation_win_apt_lazarus_loader.yml

title: Lazarus Loaders
id: 7b49c990-4a9a-4e65-ba95-47c9cc448f6e
description: Detects different loaders as described in various threat reports on Lazarus group activity
status: experimental
references:
    - https://www.hvs-consulting.de/lazarus-report/
    - https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/
tags:
    - attack.g0032
    - attack.execution
    - attack.t1059 
author: Florian Roth, wagga
date: 2020/12/23
modified: 2021/06/27
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd1:
        CommandLine|contains|all: 
            - 'cmd.exe /c '
            - ' -p 0x'
    selection_cmd2:
        CommandLine|contains:
            - 'C:\ProgramData\'
            - 'C:\RECYCLER\'
    selection_rundll1:
        CommandLine|contains|all: 
            - 'rundll32.exe '
            - 'C:\ProgramData\'
    selection_rundll2:
        CommandLine|contains:
            - '.bin,'
            - '.tmp,'
            - '.dat,'
            - '.io,'
            - '.ini,'
            - '.db,'
    condition: ( selection_cmd1 and selection_cmd2 ) or ( selection_rundll1 and selection_rundll2 )
falsepositives:
    - unknown
level: critical

proc_creation_win_apt_lazarus_session_highjack.yml

title: Lazarus Session Highjacker
id: 3f7f5b0b-5b16-476c-a85f-ab477f6dd24b
status: test
description: Detects executables launched outside their default directories as used by Lazarus Group (Bluenoroff)
author: Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)
references:
  - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180244/Lazarus_Under_The_Hood_PDF_final.pdf
date: 2020/06/03
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\msdtc.exe'
      - '\gpvc.exe'
  filter:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection and not filter
falsepositives:
  - unknown
level: high
tags:
  - attack.defense_evasion
  - attack.t1036.005

proc_creation_win_apt_muddywater_dnstunnel.yml

title: DNS Tunnel Technique from MuddyWater
id: 36222790-0d43-4fe8-86e4-674b27809543
status: test
description: Detecting DNS tunnel activity for Muddywater actor
author: '@caliskanfurkan_'
references:
  - https://www.virustotal.com/gui/file/5ad401c3a568bd87dd13f8a9ddc4e450ece61cd9ce4d1b23f68ce0b1f3c190b7/
  - https://www.vmray.com/analyses/5ad401c3a568/report/overview.html
date: 2020/06/04
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
    ParentImage|endswith:
      - '\excel.exe'
    CommandLine|contains:
      - 'DataExchange.dll'
  condition: selection
falsepositives:
  - Unknown
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.004

proc_creation_win_apt_mustangpanda.yml

title: Mustang Panda Dropper
id: 2d87d610-d760-45ee-a7e6-7a6f2a65de00
status: test
description: Detects specific process parameters as used by Mustang Panda droppers
author: Florian Roth, oscd.community
references:
  - https://app.any.run/tasks/7ca5661d-a67b-43ec-98c1-dd7a8103c256/
  - https://app.any.run/tasks/b12cccf3-1c22-4e28-9d3e-c7a6062f3914/
  - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
date: 2019/10/30
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    - CommandLine|contains:
      - 'Temp\wtask.exe /create'
      - '%windir:~-3,1%%PUBLIC:~-9,1%'
      - '/tn "Security Script '
      - '%windir:~-1,1%'
    - CommandLine|contains|all:
      - '/E:vbscript'
      - 'C:\Users\'
      - '.txt'
      - '/F'
  selection2:
    Image|endswith: 'Temp\winwsh.exe'
  condition: 1 of selection*
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Unlikely
level: high
tags:
  - attack.t1587.001
  - attack.resource_development

proc_creation_win_apt_pandemic.yml

title: Pandemic Registry Key
id: 9fefd33c-339d-4495-9cba-b96ca006f512
related:
    - id: 47e0852a-cf81-4494-a8e6-31864f8c86ed
      type: derived
status: experimental
description: Detects Pandemic Windows Implant
references:
    - https://wikileaks.org/vault7/#Pandemic
    - https://twitter.com/MalwareJake/status/870349480356454401
tags:
    - attack.lateral_movement
    - attack.t1105
author: Florian Roth
date: 2017/06/01
modified: 2021/09/12
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'loaddll -a '
    condition: selection
falsepositives:
    - unknown
level: critical
fields:
    - EventID
    - CommandLine
    - ParentCommandLine
    - Image
    - User
    - TargetObject

proc_creation_win_apt_revil_kaseya.yml

title: REvil Kaseya Incident Malware Patterns
id: 5de632bc-7fbd-4c8a-944a-fce55c59eae5
status: experimental
description: Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)
references:
    - https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers
    - https://www.joesandbox.com/analysis/443736/0/html
    - https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
    - https://therecord.media/revil-ransomware-executes-supply-chain-attack-via-malicious-kaseya-update/
    - https://blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/
author: Florian Roth
date: 2021/07/03
modified: 2022/02/28
tags:
    - attack.execution
    - attack.t1059 
    - attack.g0115
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains:
            - 'C:\Windows\cert.exe'
            - 'Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled'
            - 'del /q /f c:\kworking\agent.crt'
            - 'Kaseya VSA Agent Hot-fix'
            - '\AppData\Local\Temp\MsMpEng.exe'
            - 'rmdir /s /q %SystemDrive%\inetpub\logs'
            - 'del /s /q /f %SystemDrive%\\*.log'
            - 'c:\kworking1\agent.exe'
            - 'c:\kworking1\agent.crt'
    selection2:
        Image: 
            - 'C:\Windows\MsMpEng.exe'
            - 'C:\Windows\cert.exe'
            - 'C:\kworking\agent.exe'
            - 'C:\kworking1\agent.exe'
    selection3:
        CommandLine|contains|all:
            - 'del /s /q /f'
            - 'WebPages\Errors\webErrorLog.txt'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: critical

proc_creation_win_apt_slingshot.yml

title: Defrag Deactivation
id: 958d81aa-8566-4cea-a565-59ccd4df27b0
description: Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
status: experimental
author: Florian Roth, Bartlomiej Czyz (@bczyz1)
date: 2019/03/04
modified: 2021/09/19
references:
    - https://securelist.com/apt-slingshot/84312/
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.s0111
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains:
            - '/delete'
            - '/change'
        CommandLine|contains|all:
            - '/TN'
            - '\Microsoft\Windows\Defrag\ScheduledDefrag'
    condition: selection
falsepositives:
    - Unknown
level: medium

proc_creation_win_apt_sofacy.yml

title: Sofacy Trojan Loader Activity
id: ba778144-5e3d-40cf-8af9-e28fb1df1e20
author: Florian Roth, Jonhnathan Ribeiro, oscd.community
status: experimental
date: 2018/03/01
modified: 2021/12/08
description: Detects Trojan loader acitivty as used by APT28
references:
    - https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/
    - https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100
    - https://twitter.com/ClearskySec/status/960924755355369472
tags:
    - attack.g0007
    - attack.execution
    - attack.t1059.003
    - attack.defense_evasion
    - car.2013-10-002
    - attack.t1218.011
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains|all:
            - 'rundll32.exe'
            - '%APPDATA%\'
    selection2:
        - CommandLine|contains: '.dat",'
        - CommandLine|endswith: 
            - '.dll",#1'
            - '.dll #1'
            - '.dll" #1'
    condition: selection1 and selection2
falsepositives:
    - Unknown
level: critical

proc_creation_win_apt_sourgrum.yml

title: SOURGUM Actor Behaviours
id: 7ba08e95-1e0b-40cd-9db5-b980555e42fd
description: Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
author: MSTIC, FPT.EagleEye
status: experimental
level: high
references:
    - https://www.virustotal.com/gui/file/c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d/detection
    - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SOURGUM_IOC.yaml
    - https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
date: 2021/06/15
modified: 2021/07/30
tags:
    - attack.t1546
    - attack.t1546.015
    - attack.persistence
    - attack.privilege_escalation
logsource:
    product: windows
    category: process_creation
detection:
    selection1:
        Image|contains: 'windows\system32\Physmem.sys'
    selection2:
        Image|contains: 
            - 'Windows\system32\ime\SHARED\WimBootConfigurations.ini'
            - 'Windows\system32\ime\IMEJP\WimBootConfigurations.ini'
            - 'Windows\system32\ime\IMETC\WimBootConfigurations.ini'
    selection3:
        Image|contains:
            - 'windows\system32\filepath2'
            - 'windows\system32\ime'
    registry_command:
        CommandLine|contains:
            - 'reg add'
    registry_key:
        CommandLine|contains: 
            - 'HKEY_LOCAL_MACHINE\software\classes\clsid\{7c857801-7381-11cf-884d-00aa004b2e24}\inprocserver32'
            - 'HKEY_LOCAL_MACHINE\software\classes\clsid\{cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}\inprocserver32'
    condition: selection1 or selection2 or (selection3 and registry_command and registry_key)
falsepositives:
    - Unknown

proc_creation_win_apt_ta17_293a_ps.yml

title: Ps.exe Renamed SysInternals Tool
id: 18da1007-3f26-470f-875d-f77faf1cab31
status: test
description: Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report
author: Florian Roth
references:
  - https://www.us-cert.gov/ncas/alerts/TA17-293A
date: 2017/10/22
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: 'ps.exe -accepteula'
  condition: selection
falsepositives:
  - Renamed SysInternals tool
level: high
tags:
  - attack.defense_evasion
  - attack.g0035
  - attack.t1036.003
  - car.2013-05-009

proc_creation_win_apt_ta505_dropper.yml

title: TA505 Dropper Load Pattern
id: 18cf6cf0-39b0-4c22-9593-e244bdc9a2d4
status: test
description: Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents
author: Florian Roth
references:
  - https://twitter.com/ForensicITGuy/status/1334734244120309760
date: 2020/12/08
modified: 2022/01/07
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mshta.exe'
    ParentImage|endswith: '\wmiprvse.exe'
  condition: selection
falsepositives:
  - unknown
level: critical
tags:
  - attack.execution
  - attack.g0092
  - attack.t1106

proc_creation_win_apt_taidoor.yml

title: TAIDOOR RAT DLL Load
id: d1aa3382-abab-446f-96ea-4de52908210b
status: test
description: Detects specific process characteristics of Chinese TAIDOOR RAT malware load
author: Florian Roth
references:
  - https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a
date: 2020/07/30
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains:
      - 'dll,MyStart'
      - 'dll MyStart'
  selection2a:
    CommandLine|endswith:
      - ' MyStart'
  selection2b:
    CommandLine|contains:
      - 'rundll32.exe'
  condition: selection1 or ( selection2a and selection2b )
falsepositives:
  - Unknown
level: critical
tags:
  - attack.execution
  - attack.t1055.001

proc_creation_win_apt_tropictrooper.yml

title: TropicTrooper Campaign November 2018
id: 8c7090c3-e0a0-4944-bd08-08c3a0cecf79
author: '@41thexplorer, Microsoft Defender ATP'
status: stable
date: 2019/11/12
modified: 2020/08/27
description: Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia
references:
    - https://cloudblogs.microsoft.com/microsoftsecure/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc'
    condition: selection
level: high

proc_creation_win_apt_turla_commands_critical.yml

title: Turla Group Lateral Movement
id: c601f20d-570a-4cde-a7d6-e17f99cb8e7f
status: experimental
description: Detects automated lateral movement by Turla group
references:
    - https://securelist.com/the-epic-turla-operation/65545/
tags:
    - attack.g0010
    - attack.execution
    - attack.t1059
    - attack.lateral_movement
    - attack.t1021.002
    - attack.discovery
    - attack.t1083
    - attack.t1135
author: Markus Neis
date: 2017/11/07
modified: 2021/09/19
logsource:
    category: process_creation
    product: windows
detection:
   selection:
      CommandLine:
         - 'net use \\%DomainController%\C$ "P@ssw0rd" *'
         - 'dir c:\\*.doc* /s'
         - 'dir %TEMP%\\*.exe'
   condition: selection
level: critical
falsepositives:
   - Unknown

proc_creation_win_apt_turla_commands_medium.yml

title: Turla Group Lateral Movement
id: 75925535-ca97-4e0a-a850-00b5c00779dc
status: experimental
description: Detects automated lateral movement by Turla group
references:
    - https://securelist.com/the-epic-turla-operation/65545/
tags:
    - attack.g0010
    - attack.execution
    - attack.t1059
    - attack.lateral_movement
    - attack.t1021.002
    - attack.discovery
    - attack.t1083
    - attack.t1135
author: Markus Neis
date: 2017/11/07
modified: 2021/09/19
logsource:
    category: process_creation
    product: windows
detection:
   netCommand1:
      CommandLine: 'net view /DOMAIN'
   netCommand2:
      CommandLine: 'net session'
   netCommand3:
      CommandLine: 'net share'
   timeframe: 1m
   condition: netCommand1 | near netCommand2 and netCommand3
level: medium
falsepositives:
   - Unknown

proc_creation_win_apt_turla_comrat_may20.yml


title: Turla Group Commands May 2020
id: 9e2e51c5-c699-4794-ba5a-29f5da40ac0c
status: test
description: Detects commands used by Turla group as reported by ESET in May 2020
author: Florian Roth
references:
  - https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
date: 2020/05/26
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains:
      - 'tracert -h 10 yahoo.com'
      - '.WSqmCons))|iex;'
      - 'Fr`omBa`se6`4Str`ing'
  selection2:
    CommandLine|contains|all:
      - 'net use https://docs.live.net'
      - '@aol.co.uk'
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
tags:
  - attack.g0010
  - attack.execution
  - attack.t1059.001
  - attack.t1053.005
  - attack.t1027

proc_creation_win_apt_unc2452_cmds.yml

title: UNC2452 Process Creation Patterns
id: 9be34ad0-b6a7-4fbd-91cf-fc7ec1047f5f
description: Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries
status: experimental
references:
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
tags:
    - attack.execution
    - attack.t1059.001
    # - sunburst
    # - unc2452
author: Florian Roth
date: 2021/01/22
modified: 2021/06/27
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains: 
            - '7z.exe a -v500m -mx9 -r0 -p'
    selection2:
        ParentCommandLine|contains|all:
            - 'wscript.exe'
            - '.vbs'
        CommandLine|contains|all:
            - 'rundll32.exe'
            - 'C:\Windows'
            - '.dll,Tk_'
    selection3:
        ParentImage|endswith: '\rundll32.exe'
        ParentCommandLine|contains: 'C:\Windows'
        CommandLine|contains: 'cmd.exe /C '
    selection4:
        CommandLine|contains|all: 
            - 'rundll32 c:\windows\'
            - '.dll '
    specific1:
        ParentImage|endswith: '\rundll32.exe'
        Image|endswith: '\dllhost.exe'
    filter1:
        CommandLine: 
            - ' '
            - ''
    condition: selection1 or selection2 or selection3 or selection4 or ( specific1 and not filter1 )
falsepositives:
    - Unknown
level: critical

proc_creation_wi_apt_unc2452_ps.yml

title: UNC2452 PowerShell Pattern
id: b7155193-8a81-4d8f-805d-88de864ca50c
description: Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports
status: experimental
references:
    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware
    - https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md#atomic-test-7---create-a-process-using-wmi-query-and-an-encoded-command
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1047
    # - sunburst
author: Florian Roth
date: 2021/01/20
modified: 2021/01/22
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains|all: 
            - 'Invoke-WMIMethod win32_process -name create -argumentlist'
            - 'rundll32 c:\windows'
    selection2:
         CommandLine|contains|all: 
            - 'wmic /node:'
            - 'process call create "rundll32 c:\windows'   
    condition: selection1 or selection2
falsepositives:
    - Unknown, unlikely, but possible
level: critical

proc_creation_win_apt_unidentified_nov_18.yml

title: Unidentified Attacker November 2018
id: 7453575c-a747-40b9-839b-125a0aae324b
status: stable
description: A sigma rule detecting an unidetefied attacker who used phishing emails to target high profile orgs on November 2018. The Actor shares some TTPs with
    YYTRIUM/APT29 campaign in 2016.
references:
    - https://twitter.com/DrunkBinary/status/1063075530180886529
author: '@41thexplorer, Microsoft Defender ATP'
date: 2018/11/20
modified: 2021/09/19
tags:
    - attack.execution
    - attack.t1218.011
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'cyzfc.dat,'
        CommandLine|endswith: 'PointFunctionCall'
    condition: selection
level: high

proc_creation_win_apt_winnti_mal_hk_jan20.yml

title: Winnti Malware HK University Campaign
id: 3121461b-5aa0-4a41-b910-66d25524edbb
status: test
description: Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities
author: Florian Roth, Markus Neis
references:
  - https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/
date: 2020/02/01
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    ParentImage|contains:
      - 'C:\Windows\Temp'
      - '\hpqhvind.exe'
    Image|startswith: 'C:\ProgramData\DRM'
  selection2:
    ParentImage|startswith: 'C:\ProgramData\DRM'
    Image|endswith: '\wmplayer.exe'
  selection3:
    ParentImage|endswith: '\Test.exe'
    Image|endswith: '\wmplayer.exe'
  selection4:
    Image: 'C:\ProgramData\DRM\CLR\CLR.exe'
  selection5:
    ParentImage|startswith: 'C:\ProgramData\DRM\Windows'
    Image|endswith: '\SearchFilterHost.exe'
  condition: 1 of selection*
falsepositives:
  - Unlikely
level: critical
tags:
  - attack.defense_evasion
  - attack.t1574.002
  - attack.g0044

proc_creation_win_apt_winnti_pipemon.yml

title: Winnti Pipemon Characteristics
id: 73d70463-75c9-4258-92c6-17500fe972f2
status: test
description: Detects specific process characteristics of Winnti Pipemon malware reported by ESET
author: Florian Roth, oscd.community
references:
  - https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
date: 2020/07/30
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains:
      - 'setup0.exe -p'
  selection2:
    CommandLine|contains|all:
      - 'setup.exe'
    CommandLine|endswith:
      - '-x:0'
      - '-x:1'
      - '-x:2'
  condition: 1 of selection*
falsepositives:
  - Legitimate setups that use similar flags
level: critical
tags:
  - attack.defense_evasion
  - attack.t1574.002
  - attack.g0044

proc_creation_win_apt_wocao.yml

title: Operation Wocao Activity
id: 1cfac73c-be78-4f9a-9b08-5bde0c3953ab
related:
    - id: 74ad4314-482e-4c3e-b237-3f7ed3b9ca8d
      type: derived
author: Florian Roth, frack113
status: experimental
description: Detects activity mentioned in Operation Wocao report
references:
    - https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
    - https://twitter.com/SBousseaden/status/1207671369963646976
tags:
    - attack.discovery 
    - attack.t1012
    - attack.defense_evasion
    - attack.t1036.004
    - attack.t1027
    - attack.execution
    - attack.t1053.005
    - attack.t1059.001
date: 2019/12/20
modified: 2021/09/19
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 
            - 'checkadmin.exe 127.0.0.1 -all'
            - 'netsh advfirewall firewall add rule name=powershell dir=in'
            - 'cmd /c powershell.exe -ep bypass -file c:\s.ps1'
            - '/tn win32times /f'
            - 'create win32times binPath='
            - '\c$\windows\system32\devmgr.dll'
            - ' -exec bypass -enc JgAg'
            - 'type *keepass\KeePass.config.xml'
            - 'iie.exe iie.txt'
            - 'reg query HKEY_CURRENT_USER\Software\\*\PuTTY\Sessions\'
    condition: selection
falsepositives:
    - Administrators that use checkadmin.exe tool to enumerate local administrators
level: high

proc_creation_win_apt_zxshell.yml

title: ZxShell Malware
id: f0b70adb-0075-43b0-9745-e82a1c608fcc
status: test
description: Detects a ZxShell start by the called and well-known function name
author: Florian Roth, oscd.community, Jonhnathan Ribeiro
references:
  - https://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16?environmentId=100
date: 2017/07/20
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rundll32.exe'
    CommandLine|contains:
      - 'zxFunction'
      - 'RemoteDiskXXXXX'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Unlikely
level: critical
tags:
  - attack.execution
  - attack.t1059.003
  - attack.defense_evasion
  - attack.t1218.011
  - attack.s0412
  - attack.g0001

raw_access_thread

sysmon_raw_disk_access_using_illegitimate_tools.yml

registry_event

sysmon

sysmon_accessing_winapi_in_powershell_credentials_dumping.yml
sysmon_config_modification.yml
sysmon_config_modification_error.yml
sysmon_config_modification_status.yml
sysmon_dcom_iertutil_dll_hijack.yml
sysmon_process_hollowing.yml

wmi_event

sysmon_wmi_event_subscription.yml
sysmon_wmi_susp_encoded_scripts.yml
sysmon_wmi_susp_scripting.yml

Sigma - 规则

Antivirus Exploitation Framework Detection

Antivirus Hacktool Detection

Antivirus Password Dumper Detection

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Antivirus Relevant File Paths Alerts

Antivirus Web Shell Detection

Django Framework Exceptions

EDR WMI Command Execution by Office Applications

Python SQL Exceptions

Remote Schedule Task Lateral Movement via ATSvc

Remote Schedule Task Recon via AtScv

Possible DCSync Attack

Remote Encrypting File System Abuse

Remote Event Log Recon

Remote Schedule Task Lateral Movement via ITaskSchedulerService

Remote Schedule Task Recon via ITaskSchedulerService

Remote Printing Abuse for Lateral Movement

Remote DCOM/WMI Lateral Movement

Remote Registry Lateral Movement

Remote Registry Recon

Remote Server Service Abuse

Remote Server Service Abuse for Lateral Movement

Remote Schedule Task Lateral Movement via SASec

Remote Schedule Task Lateral Movement via SASec

SharpHound Recon Account Discovery

SharpHound Recon Sessions

Ruby on Rails Framework Exceptions

Spring Framework Exceptions

Suspicious SQL Error Messages

Silence.Downloader V3

Silence EDA Detection

Brute Force

APT

APT40 Dropbox Tool User Agent

Domestic Kitten FurBall Malware Pattern

BabyShark Agent Pattern

Chafer Malware URL Pattern

Turla ComRAT

APT UserAgent

CobaltStrike

🙋‍♀️🙋‍♀️🙋‍♀️Cobalt Strike Malleable Amazon Browsing Traffic Profile

🙋‍♀️🙋‍♀️🙋‍♀️Cobalt Strike Malformed UAs in Malleable Profiles

CobaltStrike Malleable (OCSP) Profile

CobaltStrike Malleable OneDrive Browsing Traffic Profile

Windows PowerShell User Agent

KeyWords

Detect Sql Injection By Keywords

Webshell Detection by Keyword

Detect XSS Attempts By Keywords

🙋‍♀️🙋‍♀️🙋‍♀️APT🙋‍♀️🙋‍♀️🙋‍♀️

Turla Service Install

Chafer Activity

StoneDrill Service Install

Turla PNG Dropper Service

CobaltStrike Service Installations

Moriya Rootkit

Rare Scheduled Task Creations

Mimikatz Use

CobaltStrike Process Injection

CreateRemoteThread API and LoadLibrary

Accessing WinAPI in PowerShell. Code Injection.

PowerShell Rundll32 Remote Thread Creation

Suspicious Remote Thread Created

Password Dumper Remote Thread in LSASS

CACTUSTORCH Remote Thread Creation

Startup Folder File Write

PowerShell Writing Startup Shortcuts

Moriya Rootkit

Dump Office Macro Files from Commandline

PowerShell ShellCode Base64ed

Obfuscation

Invoke-Obfuscation CLIP+Launcher

Invoke-Obfuscation Obfuscated IEXInvocation

Invoke-Obfuscation STDIN+Launcher

Invoke-Obfuscation VAR+ Launcher

Invoke-Obfuscation COMPRESS OBFUSCATION

Invoke-Obfuscation RUNDLL LAUNCHER

Invoke-Obfuscation Via Stdin