Skip to content

Commit 1758511

Browse files
nasbenchnasbench
authored
Merge PR #4762 from @nasbench - Fix false positives found in testing
fix: Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process - Add multiple new FP filters seen in the wild fix: Potential System DLL Sideloading From Non System Locations - Add multiple new FP filters seen in the wild new: CrackMapExec File Indicators remove: CrackMapExec File Creation Patterns remove: Suspicious Epmap Connection
1 parent ce7b111 commit 1758511

6 files changed

+140
-82
lines changed

‎rules/windows/file/file_event/file_event_win_crackmapexec_patterns.yml ‎deprecated/windows/file_event_win_crackmapexec_patterns.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
title: CrackMapExec File Creation Patterns
22
id: 9433ff9c-5d3f-4269-99f8-95fc826ea489
3-
status: test
3+
status: deprecated
44
description: Detects suspicious file creation patterns found in logs when CrackMapExec is used
55
references:
66
- https://mpgn.gitbook.io/crackmapexec/smb-protocol/obtaining-credentials/dump-lsass
77
author: Florian Roth (Nextron Systems)
88
date: 2022/03/12
9-
modified: 2022/05/27
9+
modified: 2024/03/01
1010
tags:
1111
- attack.credential_access
1212
- attack.t1003.001

‎rules/windows/network_connection/net_connection_win_susp_epmap.yml ‎deprecated/windows/net_connection_win_susp_epmap.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
title: Suspicious Epmap Connection
22
id: 628d7a0b-7b84-4466-8552-e6138bc03b43
3-
status: experimental
3+
status: deprecated
44
description: Detects suspicious "epmap" connection to a remote computer via remote procedure call (RPC)
55
references:
66
- https://github.com/RiccardoAncarani/TaskShell/
77
author: frack113, Tim Shelton (fps)
88
date: 2022/07/14
9-
modified: 2023/09/28
9+
modified: 2024/03/01
1010
tags:
1111
- attack.lateral_movement
1212
logsource:

‎rules-threat-hunting/windows/image_load/image_load_dll_dbghelp_dbgcore_susp_load.yml

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
title: Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process
2+
id: 0e277796-5f23-4e49-a490-483131d4f6e1
3+
related:
4+
- id: bdc64095-d59a-42a2-8588-71fd9c9d9abc # Unsigned Loading
5+
type: similar
6+
status: test
7+
description: |
8+
Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process.
9+
The Dbghelp and Dbgcore DLLs export functions that allow for the dump of process memory. Tools like ProcessHacker, Task Manager and some attacker tradecraft use the MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
10+
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
11+
Keep in mind that many legitimate Windows processes and services might load the aforementioned DLLs for debugging or other related purposes. Investigate the CommandLine and the Image location of the process loading the DLL.
12+
references:
13+
- https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
14+
- https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
15+
- https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
16+
author: Perez Diego (@darkquassar), oscd.community, Ecco
17+
date: 2019/10/27
18+
modified: 2024/03/01
19+
tags:
20+
- attack.credential_access
21+
- attack.t1003.001
22+
- detection.threat_hunting
23+
logsource:
24+
category: image_load
25+
product: windows
26+
detection:
27+
selection:
28+
ImageLoaded|endswith:
29+
- '\dbghelp.dll'
30+
- '\dbgcore.dll'
31+
Image|endswith:
32+
- '\bash.exe'
33+
- '\cmd.exe'
34+
- '\cscript.exe'
35+
- '\dnx.exe'
36+
- '\excel.exe'
37+
- '\monitoringhost.exe'
38+
- '\msbuild.exe'
39+
- '\mshta.exe'
40+
- '\outlook.exe'
41+
- '\powerpnt.exe'
42+
- '\regsvcs.exe'
43+
- '\rundll32.exe'
44+
- '\sc.exe'
45+
- '\scriptrunner.exe'
46+
- '\winword.exe'
47+
- '\wmic.exe'
48+
- '\wscript.exe'
49+
# - '\powershell.exe' # Note: Triggered by installing common software
50+
# - '\regsvr32.exe' # Note: triggered by installing common software
51+
# - '\schtasks.exe' # Note: triggered by installing software
52+
# - '\svchost.exe' # Note: triggered by some services
53+
filter_main_tiworker:
54+
# Note: This filter requires "CommandLine" field enrichment
55+
CommandLine|startswith: 'C:\WINDOWS\WinSxS\'
56+
CommandLine|endswith: '\TiWorker.exe -Embedding'
57+
filter_main_generic:
58+
# Note: This filter requires "CommandLine" field enrichment
59+
Image|endswith: '\svchost.exe'
60+
CommandLine|endswith:
61+
- '-k LocalServiceNetworkRestricted'
62+
- '-k WerSvcGroup'
63+
filter_main_rundll32:
64+
# Note: This filter requires "CommandLine" field enrichment
65+
Image|endswith: '\rundll32.exe'
66+
CommandLine|contains:
67+
- '/d srrstr.dll,ExecuteScheduledSPPCreation'
68+
- 'aepdu.dll,AePduRunUpdate'
69+
- 'shell32.dll,OpenAs_RunDL'
70+
- 'Windows.Storage.ApplicationData.dll,CleanupTemporaryState'
71+
condition: selection and not 1 of filter_main_*
72+
falsepositives:
73+
- Debugging scripts might leverage this DLL in order to dump process memory for further analysis.
74+
level: medium

‎rules/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
title: CrackMapExec File Indicators
2+
id: 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a
3+
related:
4+
- id: 9433ff9c-5d3f-4269-99f8-95fc826ea489
5+
type: obsoletes
6+
status: experimental
7+
description: Detects file creation events with filename patterns used by CrackMapExec.
8+
references:
9+
- https://github.com/byt3bl33d3r/CrackMapExec/
10+
author: Nasreddine Bencherchali (Nextron Systems)
11+
date: 2024/03/11
12+
tags:
13+
- attack.credential_access
14+
- attack.t1003.001
15+
logsource:
16+
product: windows
17+
category: file_event
18+
detection:
19+
selection_path:
20+
TargetFilename|startswith: 'C:\Windows\Temp\' # The disk extension is hardcoded in the tool.
21+
selection_names_str:
22+
TargetFilename|endswith:
23+
- '\temp.ps1' # https://github.com/byt3bl33d3r/CrackMapExec/blob/3c3e412193cb6d3237abe90c543e5d995bfa4447/cme/modules/keepass_trigger.py#L42C41-L42C68
24+
- '\msol.ps1' # https://github.com/byt3bl33d3r/CrackMapExec/blob/3c3e412193cb6d3237abe90c543e5d995bfa4447/cme/modules/msol.py#L48C98-L48C106
25+
selection_names_re:
26+
- TargetFilename|re: '\\[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.txt$' # https://github.com/byt3bl33d3r/CrackMapExec/blob/3c3e412193cb6d3237abe90c543e5d995bfa4447/cme/protocols/wmi/wmiexec.py#L86
27+
- TargetFilename|re: '\\[a-zA-Z]{8}\.tmp$' # https://github.com/byt3bl33d3r/CrackMapExec/blob/3c3e412193cb6d3237abe90c543e5d995bfa4447/cme/protocols/smb/atexec.py#L145C19-L146
28+
condition: selection_path and 1 of selection_names_*
29+
falsepositives:
30+
- Unknown
31+
level: high

‎rules/windows/image_load/image_load_dll_dbghelp_dbgcore_susp_load.yml

-59
This file was deleted.

‎rules/windows/image_load/image_load_side_load_from_non_system_location.yml

+31-19
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ references:
1010
- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
1111
author: Nasreddine Bencherchali (Nextron Systems)
1212
date: 2022/08/14
13-
modified: 2024/01/10
13+
modified: 2024/03/11
1414
tags:
1515
- attack.defense_evasion
1616
- attack.persistence
@@ -445,36 +445,48 @@ detection:
445445
filter_main_generic:
446446
# Note: this filter is generic on purpose to avoid insane amount of FP from legitimate third party applications. A better approach would be to baseline everything and add specific filters to avoid blind spots
447447
ImageLoaded|contains:
448-
- ':\Windows\System32\'
449-
- ':\Windows\SysWOW64\'
450-
- ':\Windows\WinSxS\'
451-
- ':\Windows\SoftwareDistribution\'
452-
- ':\Windows\SystemTemp\'
453-
- ':\$WINDOWS.~BT\'
448+
- 'C:\$WINDOWS.~BT\'
449+
- 'C:\$WinREAgent\'
450+
- 'C:\Windows\SoftwareDistribution\'
451+
- 'C:\Windows\System32\'
452+
- 'C:\Windows\SystemTemp\'
453+
- 'C:\Windows\SysWOW64\'
454+
- 'C:\Windows\WinSxS\'
455+
filter_main_dot_net:
456+
ImageLoaded|startswith: 'C:\Windows\Microsoft.NET\'
457+
ImageLoaded|endswith: '\cscui.dll'
454458
filter_main_defender:
455-
Image|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
456-
Image|endswith: '\version.dll'
459+
ImageLoaded|contains: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
460+
ImageLoaded|endswith: '\version.dll'
461+
filter_optional_exchange:
462+
ImageLoaded|contains: 'C:\Program Files\Microsoft\Exchange Server\'
463+
ImageLoaded|endswith: '\mswb7.dll'
464+
filter_optional_arsenal_image_mounter:
465+
ImageLoaded|contains: 'C:\Program Files\Arsenal-Image-Mounter-'
466+
ImageLoaded|endswith:
467+
- '\mi.dll'
468+
- '\miutils.dl'
457469
filter_optional_office_appvpolicy:
458-
Image|endswith: ':\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe'
459-
ImageLoaded|endswith: ':\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll'
470+
Image|endswith: 'C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe'
471+
ImageLoaded|endswith: 'C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll'
460472
filter_optional_azure:
461-
ImageLoaded|contains: ':\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
473+
ImageLoaded|contains: 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
462474
filter_optional_dell:
463475
Image|contains:
464-
- ':\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
465-
- ':\Windows\System32\backgroundTaskHost.exe'
476+
- 'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
477+
- 'C:\Windows\System32\backgroundTaskHost.exe'
466478
ImageLoaded|contains: ':\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
467479
filter_optional_dell_wldp:
468-
Image|contains: ':\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
480+
Image|contains: 'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
469481
Image|endswith: '\wldp.dll'
470482
filter_optional_checkpoint:
471483
Image|contains:
472-
- ':\Program Files\CheckPoint\'
473-
- ':\Program Files (x86)\CheckPoint\'
484+
- 'C:\Program Files\CheckPoint\'
485+
- 'C:\Program Files (x86)\CheckPoint\'
474486
Image|endswith: '\SmartConsole.exe'
475487
ImageLoaded|contains:
476-
- ':\Program Files\CheckPoint\'
477-
- ':\Program Files (x86)\CheckPoint\'
488+
- 'C:\Program Files\CheckPoint\'
489+
- 'C:\Program Files (x86)\CheckPoint\'
478490
ImageLoaded|endswith: '\PolicyManager.dll'
479491
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
480492
falsepositives:

0 commit comments

Comments
 (0)