Skip to content

Commit af9ffdb

Browse files
nasbenchnasbench
authored
Merge branch 'SigmaHQ:master' into master
2 parents f2985e6 + 313578e commit af9ffdb

File tree

76 files changed

+1265
-466
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

76 files changed

+1265
-466
lines changed

‎rules/windows/registry/registry_set/registry_set_persistence_com_hijacking_susp_locations.yml ‎deprecated/windows/registry_set_persistence_com_hijacking_susp_locations.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
title: Potential Persistence Via COM Hijacking From Suspicious Locations
22
id: 3d968d17-ffa4-4bc0-bfdc-f139de76ce77
3-
status: experimental
4-
description: Detects potential COM object hijacking where the "Server" (In/Out) is pointing to a suspicious or unsuale location
3+
status: deprecated
4+
description: Detects potential COM object hijacking where the "Server" (In/Out) is pointing to a suspicious or unusual location.
55
references:
66
- https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ (idea)
77
author: Nasreddine Bencherchali (Nextron Systems)
88
date: 2022/07/28
9-
modified: 2023/09/28
9+
modified: 2024/07/16
1010
tags:
1111
- attack.persistence
1212
- attack.t1546.015

‎rules/windows/registry/registry_event/registry_event_apt_oceanlotus_registry.yml ‎rules-emerging-threats/2018/TA/APT32-Oceanlotus/registry_event_apt_oceanlotus_registry.yml

+1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ modified: 2023/09/28
1111
tags:
1212
- attack.defense_evasion
1313
- attack.t1112
14+
- detection.emerging_threats
1415
logsource:
1516
category: registry_event
1617
product: windows

‎rules/windows/registry/registry_event/registry_event_apt_oilrig_mar18.yml ‎rules-emerging-threats/2018/TA/OilRig/registry_event_apt_oilrig_mar18.yml

+1
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ tags:
2424
- attack.t1112
2525
- attack.command_and_control
2626
- attack.t1071.004
27+
- detection.emerging_threats
2728
logsource:
2829
category: registry_event
2930
product: windows

‎rules/windows/registry/registry_add/registry_add_malware_ursnif.yml ‎rules-emerging-threats/2019/Malware/Ursnif/registry_add_malware_ursnif.yml

+1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ modified: 2023/02/07
1111
tags:
1212
- attack.execution
1313
- attack.t1112
14+
- detection.emerging_threats
1415
logsource:
1516
product: windows
1617
category: registry_add

‎rules/windows/registry/registry_event/registry_event_apt_leviathan.yml ‎rules-emerging-threats/2020/TA/Leviathan/registry_event_apt_leviathan.yml

+1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ modified: 2023/09/19
1010
tags:
1111
- attack.persistence
1212
- attack.t1547.001
13+
- detection.emerging_threats
1314
logsource:
1415
category: registry_event
1516
product: windows

‎rules-emerging-threats/2023/Exploits/CVE-2023-1389/proxy_exploit_cve_2023_1389_unauth_command_injection_tplink_archer_ax21.yml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
title: CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21
2+
id: 6c7defa9-69f8-4c34-b815-41fce3931754
3+
status: experimental
4+
description: |
5+
Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21.
6+
references:
7+
- https://www.tenable.com/security/research/tra-2023-11
8+
- https://github.com/Voyag3r-Security/CVE-2023-1389/blob/4ecada7335b17bf543c0e33b2c9fb6b6215c09ae/archer-rev-shell.py
9+
- https://www.zerodayinitiative.com/blog/2023/4/21/tp-link-wan-side-vulnerability-cve-2023-1389-added-to-the-mirai-botnet-arsenal
10+
author: Nasreddine Bencherchali (Nextron Systems), Rohit Jain
11+
date: 2024/06/25
12+
tags:
13+
- detection.emerging_threats
14+
- attack.initial_access
15+
- attack.t1190
16+
- cve.2023.1389
17+
logsource:
18+
category: proxy
19+
detection:
20+
selection_uri:
21+
cs-method:
22+
- 'GET'
23+
- 'POST'
24+
cs-uri|contains|all:
25+
- '/cgi-bin/luci/;stok=/locale'
26+
- 'form=country'
27+
selection_keyword:
28+
- 'operation=write'
29+
- 'country=$('
30+
condition: all of selection_*
31+
falsepositives:
32+
- Vulnerability Scanners
33+
level: medium

‎rules-emerging-threats/2024/TA/Forest-Blizzard/file_event_win_apt_forest_blizzard_activity.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ references:
88
- https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
99
author: Nasreddine Bencherchali (Nextron Systems)
1010
date: 2024/04/23
11+
modified: 2024/07/11
1112
tags:
1213
- attack.defense_evasion
1314
- attack.t1562.002
@@ -28,8 +29,8 @@ detection:
2829
- 'C:\ProgramData\UbiSoft\v'
2930
- 'C:\ProgramData\Steam\v'
3031
TargetFilename|contains:
31-
- '\pnms003.inf_'
32-
- '\pnms009.inf_'
32+
- '\prnms003.inf_'
33+
- '\prnms009.inf_'
3334
selection_programdata_main:
3435
TargetFilename|startswith: 'C:\ProgramData\'
3536
selection_programdata_files_1:

‎rules-threat-hunting/windows/file/file_event/file_event_win_susp_binary_dropper.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
title: Creation of an Executable by an Executable
22
id: 297afac9-5d02-4138-8c58-b977bac60556
33
status: experimental
4-
description: Detects the creation of an executable by another executable
4+
description: Detects the creation of an executable by another executable.
55
references:
6-
- Malware Sandbox
6+
- Internal Research
77
author: frack113
88
date: 2022/03/09
99
modified: 2023/11/06

‎rules/windows/network_connection/net_connection_win_dllhost_non_local_ip.yml ‎rules-threat-hunting/windows/network_connection/net_connection_win_dllhost_non_local_ip.yml

+4-2
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,21 @@ title: Dllhost.EXE Initiated Network Connection To Non-Local IP Address
22
id: cfed2f44-16df-4bf3-833a-79405198b277
33
status: test
44
description: |
5-
Detects dllhost initiating a network connection to a non-local IP address.
5+
Detects Dllhost.EXE initiating a network connection to a non-local IP address.
66
Aside from Microsoft own IP range that needs to be excluded. Network communication from Dllhost will depend entirely on the hosted DLL.
77
An initial baseline is recommended before deployment.
88
references:
99
- https://redcanary.com/blog/child-processes/
1010
- https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08
1111
author: bartblaze
1212
date: 2020/07/13
13-
modified: 2024/03/12
13+
modified: 2024/07/16
1414
tags:
1515
- attack.defense_evasion
1616
- attack.t1218
1717
- attack.execution
1818
- attack.t1559.001
19+
- detection.threat_hunting
1920
logsource:
2021
category: network_connection
2122
product: windows
@@ -42,6 +43,7 @@ detection:
4243
- '51.103.0.0/16' # Microsoft Corporation
4344
- '51.104.0.0/15' # Microsoft Corporation
4445
- '52.224.0.0/11' # Microsoft Corporation
46+
- '150.171.0.0/19' # Microsoft Corporation
4547
- '204.79.197.0/24' # Microsoft Corporation'
4648
condition: selection and not 1 of filter_main_*
4749
falsepositives:

‎rules/windows/network_connection/net_connection_win_msiexec_http.yml ‎rules-threat-hunting/windows/network_connection/net_connection_win_msiexec_http.yml

+6-4
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,19 @@ title: Msiexec.EXE Initiated Network Connection Over HTTP
22
id: 8e5e38e4-5350-4c0b-895a-e872ce0dd54f
33
status: test
44
description: |
5-
Detects an initiated network connection by "Msiexec.exe" over port 80 or 443.
5+
Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443.
66
Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages.
7+
Use this rule to hunt for potentially anomalous or suspicious communications.
78
references:
89
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
910
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
1011
author: frack113
1112
date: 2022/01/16
12-
modified: 2024/02/01
13+
modified: 2024/07/16
1314
tags:
1415
- attack.defense_evasion
1516
- attack.t1218.007
17+
- detection.threat_hunting
1618
logsource:
1719
category: network_connection
1820
product: windows
@@ -25,5 +27,5 @@ detection:
2527
- 443
2628
condition: selection
2729
falsepositives:
28-
- Some rare installers were seen communicating with external servers for additional information. While its a very rare occurrence in some environments an initial baseline might be required.
29-
level: high
30+
- Likely
31+
level: low

‎rules-threat-hunting/windows/process_access/proc_access_win_susp_potential_shellcode_injection.yml

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
title: Potential Shellcode Injection
2+
id: 250ae82f-736e-4844-a68b-0b5e8cc887da
3+
status: test
4+
description: Detects potential shellcode injection as seen used by tools such as Metasploit's migrate and Empire's psinject.
5+
references:
6+
- https://github.com/EmpireProject/PSInject
7+
author: Bhabesh Raj
8+
date: 2022/03/11
9+
modified: 2024/07/02
10+
tags:
11+
- attack.defense_evasion
12+
- attack.privilege_escalation
13+
- attack.t1055
14+
- detection.threat_hunting
15+
logsource:
16+
category: process_access
17+
product: windows
18+
detection:
19+
selection:
20+
GrantedAccess:
21+
- '0x147a'
22+
- '0x1f3fff'
23+
CallTrace|contains: 'UNKNOWN'
24+
filter_main_wmiprvse:
25+
SourceImage: 'C:\Windows\System32\Wbem\Wmiprvse.exe'
26+
TargetImage: 'C:\Windows\system32\lsass.exe'
27+
filter_optional_dell_folders:
28+
# If dell software is installed we get matches like these
29+
# Example 1:
30+
# SourceImage: C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
31+
# TargetImage: C:\Program Files\Dell\TechHub\Dell.TechHub.exe
32+
# GrantedAccess: 0x1F3FFF
33+
# Example 2:
34+
# SourceImage: C:\Program Files (x86)\Dell\UpdateService\DCF\Dell.DCF.UA.Bradbury.API.SubAgent.exe
35+
# TargetImage: C:\Program Files\Dell\TechHub\Dell.TechHub.exe
36+
# GrantedAccess: 0x1F3FFF
37+
# Example 3:
38+
# SourceImage: C:\Program Files\Dell\TechHub\Dell.TechHub.exe
39+
# TargetImage: C:\Program Files (x86)\Dell\UpdateService\DCF\Dell.DCF.UA.Bradbury.API.SubAgent.exe
40+
# GrantedAccess: 0x1F3FFF
41+
SourceImage|startswith:
42+
- 'C:\Program Files\Dell\'
43+
- 'C:\Program Files (x86)\Dell\'
44+
TargetImage|startswith:
45+
- 'C:\Program Files\Dell\'
46+
- 'C:\Program Files (x86)\Dell\'
47+
filter_optional_dell_specifc:
48+
SourceImage: 'C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe'
49+
TargetImage: 'C:\Windows\Explorer.EXE'
50+
filter_optional_visual_studio:
51+
SourceImage|startswith: 'C:\Program Files\Microsoft Visual Studio\'
52+
TargetImage|startswith: 'C:\Program Files\Microsoft Visual Studio\'
53+
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
54+
falsepositives:
55+
- Unknown
56+
level: medium

‎rules/windows/process_creation/proc_creation_win_7zip_password_extraction.yml ‎rules-threat-hunting/windows/process_creation/proc_creation_win_7zip_password_extraction.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,11 @@ references:
66
- https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/
77
author: Nasreddine Bencherchali (Nextron Systems)
88
date: 2023/03/10
9+
modified: 2024/07/16
910
tags:
1011
- attack.collection
1112
- attack.t1560.001
13+
- detection.threat_hunting
1214
logsource:
1315
category: process_creation
1416
product: windows
@@ -30,4 +32,4 @@ detection:
3032
condition: all of selection_*
3133
falsepositives:
3234
- Legitimate activity is expected since extracting files with a password can be common in some environment.
33-
level: medium
35+
level: low

‎rules/windows/process_creation/proc_creation_win_powershell_susp_child_processes.yml ‎rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_susp_child_processes.yml

+20-5
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,18 @@
11
title: Potentially Suspicious PowerShell Child Processes
22
id: e4b6d2a7-d8a4-4f19-acbd-943c16d90647
33
status: test
4-
description: Detects potentially suspicious child processes spawned by PowerShell
4+
description: |
5+
Detects potentially suspicious child processes spawned by PowerShell.
6+
Use this rule to hunt for potential anomalies initiating from PowerShell scripts and commands.
57
references:
68
- https://twitter.com/ankit_anubhav/status/1518835408502620162
79
author: Florian Roth (Nextron Systems), Tim Shelton
810
date: 2022/04/26
9-
modified: 2023/05/30
11+
modified: 2024/07/16
1012
tags:
1113
- attack.execution
1214
- attack.t1059.001
15+
- detection.threat_hunting
1316
logsource:
1417
category: process_creation
1518
product: windows
@@ -38,7 +41,19 @@ detection:
3841
filter_optional_amazon:
3942
ParentCommandLine|contains: '\Program Files\Amazon\WorkspacesConfig\Scripts\' # AWS Workspaces
4043
CommandLine|contains: '\Program Files\Amazon\WorkspacesConfig\Scripts\' # AWS Workspaces
41-
condition: selection and not 1 of filter_optional_*
44+
filter_main_certutil_verify_store:
45+
Image|endswith: '\certutil.exe'
46+
CommandLine|contains: '-verifystore '
47+
filter_main_wmic:
48+
Image|endswith: '\wmic.exe'
49+
CommandLine|contains:
50+
- 'qfe list'
51+
- 'diskdrive '
52+
- 'csproduct '
53+
- 'computersystem '
54+
- ' os '
55+
- ''
56+
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
4257
falsepositives:
43-
- Some false positive is to be expected from PowerShell scripts that might make use of additional binaries such as "mshta", "bitsadmin", etc. Apply additional filters for those scripts when needed.
44-
level: high
58+
- False positives are to be expected from PowerShell scripts that might make use of additional binaries such as "mshta", "bitsadmin", etc. Apply additional filters for those scripts.
59+
level: medium

‎rules/windows/process_creation/proc_creation_win_rundll32_by_ordinal.yml ‎rules-threat-hunting/windows/process_creation/proc_creation_win_rundll32_by_ordinal.yml

+10-9
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
1-
title: Suspicious Call by Ordinal
1+
title: DLL Call by Ordinal Via Rundll32.EXE
22
id: e79a9e79-eb72-4e78-a628-0e7e8f59e89c
33
status: stable
4-
description: Detects suspicious calls of DLLs in rundll32.dll exports by ordinal
4+
description: Detects calls of DLLs exports by ordinal numbers via rundll32.dll.
55
references:
66
- https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/
77
- https://github.com/Neo23x0/DLLRunner
88
- https://twitter.com/cyb3rops/status/1186631731543236608
99
- https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/
1010
author: Florian Roth (Nextron Systems)
1111
date: 2019/10/22
12-
modified: 2023/02/09
12+
modified: 2024/07/16
1313
tags:
1414
- attack.defense_evasion
1515
- attack.t1218.011
16+
- detection.threat_hunting
1617
logsource:
1718
category: process_creation
1819
product: windows
@@ -26,11 +27,11 @@ detection:
2627
- ', #'
2728
- '.dll #' # Sysmon removes , in its log
2829
- '.ocx #' # HermeticWizard
29-
filter_edge:
30+
filter_optional_edge:
3031
CommandLine|contains|all:
3132
- 'EDGEHTML.dll'
3233
- '#141'
33-
filter_vsbuild_dll:
34+
filter_optional_vsbuild_dll:
3435
ParentImage|contains:
3536
- '\Msbuild\Current\Bin\'
3637
- '\VC\Tools\MSVC\'
@@ -40,8 +41,8 @@ detection:
4041
- '\FileTracker32.dll",#1'
4142
- '\FileTracker64.dll,#1'
4243
- '\FileTracker64.dll",#1'
43-
condition: all of selection_* and not 1 of filter_*
44+
condition: all of selection_* and not 1 of filter_optional_*
4445
falsepositives:
45-
- False positives depend on scripts and administrative tools used in the monitored environment
46-
- Windows control panel elements have been identified as source (mmc)
47-
level: high
46+
- False positives depend on scripts and administrative tools used in the monitored environment.
47+
- Windows control panel elements have been identified as source (mmc).
48+
level: medium

‎rules/windows/process_creation/proc_creation_win_susp_execution_from_guid_folder_names.yml ‎rules-threat-hunting/windows/process_creation/proc_creation_win_susp_execution_from_guid_folder_names.yml

+13-6
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
1-
title: Suspicious Execution From GUID Like Folder Names
1+
title: Potential Suspicious Execution From GUID Like Folder Names
22
id: 90b63c33-2b97-4631-a011-ceb0f47b77c3
33
status: test
4-
description: Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks
4+
description: |
5+
Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks.
6+
Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.
57
references:
68
- https://twitter.com/Kostastsale/status/1565257924204986369
79
author: Nasreddine Bencherchali (Nextron Systems)
@@ -10,6 +12,7 @@ modified: 2023/03/02
1012
tags:
1113
- attack.defense_evasion
1214
- attack.t1027
15+
- detection.threat_hunting
1316
logsource:
1417
category: process_creation
1518
product: windows
@@ -27,15 +30,19 @@ detection:
2730
CommandLine|contains|all:
2831
- '\{'
2932
- '}\'
30-
filter:
33+
filter_main_image_guid:
3134
Image|contains|all:
3235
- '\{'
3336
- '}\'
34-
filter_null:
37+
filter_main_null:
3538
Image: null
36-
filter_driver_inst: # DrvInst.exe "4" "0" "C:\Users\venom\AppData\Local\Temp\{a0753cc2-fcea-4d49-a787-2290b564b06f}\nvvhci.inf" "9" "43a2fa8e7" "00000000000001C0" "WinSta0\Default" "00000000000001C4" "208" "c:\program files\nvidia corporation\installer2\nvvhci.{eb7b4460-7ec9-42d6-b73f-d487d4550526}"
39+
filter_main_driver_inst: # DrvInst.exe "4" "0" "C:\Users\venom\AppData\Local\Temp\{a0753cc2-fcea-4d49-a787-2290b564b06f}\nvvhci.inf" "9" "43a2fa8e7" "00000000000001C0" "WinSta0\Default" "00000000000001C4" "208" "c:\program files\nvidia corporation\installer2\nvvhci.{eb7b4460-7ec9-42d6-b73f-d487d4550526}"
3740
Image: 'C:\Windows\System32\drvinst.exe'
41+
filter_main_msiexec:
42+
Image:
43+
- 'C:\Windows\System32\msiexec.exe'
44+
- 'C:\Windows\SysWOW64\msiexec.exe'
3845
condition: all of selection_* and not 1 of filter*
3946
falsepositives:
4047
- Installers are sometimes known for creating temporary folders with GUID like names. Add appropriate filters accordingly
41-
level: medium
48+
level: low

0 commit comments

Comments
 (0)