diff --git a/rules/credentail_access_file_access_to_sam_database.yml b/rules/credentail_access_file_access_to_sam_database.yml index 7e290d6fe..3cdafb811 100644 --- a/rules/credentail_access_file_access_to_sam_database.yml +++ b/rules/credentail_access_file_access_to_sam_database.yml @@ -1,6 +1,6 @@ name: File access to SAM database id: e3dace20-4962-4381-884e-40dcdde66626 -version: 1.0.7 +version: 1.0.8 description: | Identifies access to the Security Account Manager on-disk database. labels: @@ -33,7 +33,8 @@ condition: > '?:\\Windows\\System32\\vmwp.exe', '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe', '?:\\Windows\\System32\\wuauclt.exe', - '?:\\Windows\\System32\\MRT.exe' + '?:\\Windows\\System32\\MRT.exe', + '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe' ) min-engine-version: 3.0.0 diff --git a/rules/credential_access_registry_access_to_sam_database.yml b/rules/credential_access_registry_access_to_sam_database.yml index e080ee2f9..74f4d3bbf 100644 --- a/rules/credential_access_registry_access_to_sam_database.yml +++ b/rules/credential_access_registry_access_to_sam_database.yml @@ -1,6 +1,6 @@ name: Registry access to SAM database id: 2f326557-0291-4eb1-a87a-7a17b7d941cb -version: 2.0.3 +version: 2.0.4 description: Identifies access to the Security Account Manager registry hives. labels: @@ -35,6 +35,7 @@ condition: > registry.path not imatches ( 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users', + 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\*\\InprocServer32', 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names', 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\WDAGUtilityAccount\\ChannelReferences', 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account', diff --git a/rules/credential_access_suspicious_access_to_windows_manager_files.yml b/rules/credential_access_suspicious_access_to_windows_manager_files.yml index e3b98ca87..f423c4f20 100644 --- a/rules/credential_access_suspicious_access_to_windows_manager_files.yml +++ b/rules/credential_access_suspicious_access_to_windows_manager_files.yml @@ -1,6 +1,6 @@ name: Suspicious access to Windows Credential Manager files id: 4ab688f7-94e2-481b-9c7f-c49f3a79a379 -version: 1.0.4 +version: 1.0.5 description: | Identifies suspicious processes trying to acquire credentials from the Windows Credential Manager. labels: @@ -25,7 +25,8 @@ condition: > ( '?:\\Program Files\\*', '?:\\Program Files(x86)\\*', - '?:\\Windows\\System32\\lsass.exe' + '?:\\Windows\\System32\\lsass.exe', + '?:\\Windows\\system32\\svchost.exe' ) min-engine-version: 3.0.0 diff --git a/rules/credential_access_suspicious_lsass_process_access.yml b/rules/credential_access_suspicious_lsass_process_access.yml index a99f4903b..9030e92d5 100644 --- a/rules/credential_access_suspicious_lsass_process_access.yml +++ b/rules/credential_access_suspicious_lsass_process_access.yml @@ -1,6 +1,6 @@ name: Suspicious LSASS process access id: 40e59763-62c6-4ae7-8c8a-5d4167d3b4e9 -version: 1.0.0 +version: 1.0.1 description: | Identifies processes requesting high-privilege access to the Local Security Authority Subsystem Service (LSASS) process @@ -35,12 +35,15 @@ condition: > '?:\\Windows\\system32\\MRT.exe', '?:\\Windows\\System32\\wininit.exe', '?:\\Windows\\System32\\services.exe', + '?:\\WINDOWS\\System32\\taskhostw.exe', '?:\\Windows\\Sysmon.exe', '?:\\Windows\\Sysmon64.exe', '?:\\Windows\\System32\\msiexec.exe', '?:\\Windows\\system32\\wbem\\wmiprvse.exe', '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe' - ) + ) and + not (ps.exe imatches '?:\\Windows\\System32\\lsass.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\wininit.exe') and + not (thread.callstack.final_user_module.signature.trusted = true and thread.callstack.final_user_module.signature.subject imatches '*Microsoft Corporation*' and thread.callstack.modules not imatches ('*dbgcore.dll', '*comsvcs.dll')) severity: high diff --git a/rules/credential_access_suspicious_vault_client_dll_load.yml b/rules/credential_access_suspicious_vault_client_dll_load.yml index 8adc79043..919715a88 100644 --- a/rules/credential_access_suspicious_vault_client_dll_load.yml +++ b/rules/credential_access_suspicious_vault_client_dll_load.yml @@ -1,6 +1,6 @@ name: Suspicious Vault client DLL load id: 64af2e2e-2309-4079-9c0f-985f1dd930f5 -version: 1.0.7 +version: 1.0.8 description: | Identifies loading of the Vault client DLL by an unusual process. Adversaries can abuse the functions provided by the Credential Vault Client Library to enumerate or harvest saved credentials. @@ -24,34 +24,35 @@ condition: > by ps.uuid |spawn_process and ps.sid not in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20') and ps.exe != '' and - not (ps.exe imatches - ( - '?:\\Windows\\System32\\MDMAppInstaller.exe', - '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe', - '?:\\Windows\\uus\\*\\WaaSMedicAgent.exe', - '?:\\Windows\\System32\\UCConfigTask.exe', - '?:\\Windows\\System32\\DllHost.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe', - '?:\\Program Files\\*.exe', - '?:\\Program Files (x86)\\*.exe', - '?:\\Windows\\winsxs\\*\\TiWorker.exe', - '?:\\Windows\\System32\\RuntimeBroker.exe', - '?:\\WINDOWS\\system32\\UCConfigTask.exe', - '?:\\Program Files\\WindowsApps\\Microsoft.*.exe', - '?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe', - '?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe', - '?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe', - '?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe', - '?:\\Windows\\System32\\PickerHost.exe', - '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe', - '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\AppActions.exe', - '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe', - '?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe', - '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe' - )) and + ps.exe not imatches + ( + '?:\\Windows\\System32\\MDMAppInstaller.exe', + '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe', + '?:\\Windows\\uus\\*\\WaaSMedicAgent.exe', + '?:\\Windows\\System32\\UCConfigTask.exe', + '?:\\Windows\\System32\\DllHost.exe', + '?:\\WINDOWS\\explorer.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe', + '?:\\Program Files\\*.exe', + '?:\\Program Files (x86)\\*.exe', + '?:\\Windows\\winsxs\\*\\TiWorker.exe', + '?:\\Windows\\System32\\RuntimeBroker.exe', + '?:\\WINDOWS\\system32\\UCConfigTask.exe', + '?:\\Program Files\\WindowsApps\\Microsoft.*.exe', + '?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe', + '?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe', + '?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe', + '?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe', + '?:\\Windows\\System32\\PickerHost.exe', + '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe', + '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\AppActions.exe', + '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe', + '?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe', + '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe' + ) and not (ps.exe imatches '?:\\WINDOWS\\System32\\taskhostw.exe' and ps.parent.args intersects ('-k', 'netsvcs', '-p', '-s', 'Schedule')) and not (ps.exe imatches '?:\\WINDOWS\\system32\\BackgroundTaskHost.exe' and ps.args imatches ('-ServerName:*')) and not (ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') and diff --git a/rules/defense_evasion_activation_context_memory_section_hijacking.yml b/rules/defense_evasion_activation_context_memory_section_hijacking.yml index 33738daf4..a7f9a1ae1 100644 --- a/rules/defense_evasion_activation_context_memory_section_hijacking.yml +++ b/rules/defense_evasion_activation_context_memory_section_hijacking.yml @@ -1,6 +1,6 @@ name: Activation Context memory section hijacking id: 3d56281e-9608-4a70-b7b7-7651ccd3752b -version: 1.0.0 +version: 1.0.1 description: | Detects abuses of a legitimate Windows feature present in most processes called Activation Contexts with the objective of loading an arbitrary DLL @@ -26,12 +26,16 @@ condition: > |unmap_view_file and file.view.type = 'PAGEFILE' and file.view.protection = 'READONLY' and (file.view.size = 12288 or (file.view.size = 4096 and + not (ps.exe imatches '?:\\Windows\\explorer.exe') and + not (ps.parent.exe imatches '?:\\Windows\\System32\\services.exe' and ps.exe imatches '?:\\Windows\\System32\\svchost.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches '?:\\Windows\\System32\\taskhostw.exe') and not (ps.parent.exe imatches '?:\\Windows\\explorer.exe' and ps.exe imatches '?:\\Program Files\\WindowsApps\\*.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\winlogon.exe' and ps.exe imatches '?:\\Windows\\System32\\dwm.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\winlogon.exe' and ps.exe imatches '?:\\Windows\\System32\\csrss.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches '?:\\Program Files\\Microsoft Office\\*\\ActionsServer\\ActionsServer.exe') and - not (ps.parent.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.cmdline imatches concat('*-contentproc -parentBuildID* -parentPid ', ps.ppid))) + not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches 'C:\\WINDOWS\\SystemApps\\ShellExperienceHost_*\\ShellExperienceHost.exe') and + not (ps.parent.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.cmdline imatches concat('*-contentproc -parentBuildID* -parentPid ', ps.ppid))) and + not (ps.name iin ('procexp.exe', 'procexp64.exe') and ps.signature.trusted = true and ps.signature.subject imatches '*Microsoft Corporation*') ) | |map_view_file and file.view.size = 12288 and file.view.type = 'PAGEFILE' and file.view.protection = 'READWRITE'| diff --git a/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml b/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml index a2f450c53..f4df9f4bc 100644 --- a/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml +++ b/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml @@ -1,6 +1,6 @@ name: BindFlt DLL loaded by an unusual process id: fa439e69-2a73-49f9-8385-0e7f801f67db -version: 1.0.0 +version: 1.0.1 description: | Detects the loading of bindfltapi.dll, bindflt.dll, or bindlink.dll DLL family that represents user-mode API surface of the Windows Bind Filter driver (bindflt.sys) @@ -45,7 +45,8 @@ condition: > '?:\\Users\\*\\AppData\\Local\\Docker\\Desktop\\Docker Desktop.exe' ) and not (ps.sid = 'S-1-5-18' and ps.exe imatches ('?:\\Windows\\System32\\*.exe', '?:\\Windows\\SysWOW64\\*.exe') and - ps.signature.subject imatches ('*Microsoft Windows*', '*Microsoft Corporation*') and ps.signature.trusted = true) + ps.signature.subject imatches ('*Microsoft Windows*', '*Microsoft Corporation*') and ps.signature.trusted = true) and + not (ps.exe imatches '?:\\Windows\\winsxs\\*\\TiWorker.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe') action: - name: kill diff --git a/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml b/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml index 17dca5561..34da3031a 100644 --- a/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml +++ b/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml @@ -1,6 +1,6 @@ name: CldApi DLL loaded by an unusual process id: 450aee38-e8cf-47bc-8315-d16b13d740cb -version: 1.0.0 +version: 1.0.1 description: | Detects the loading of cldapi.dll (Cloud Filter API) by processes other than those legitimately associated with Windows Cloud Files infrastructure and OneDrive @@ -27,13 +27,15 @@ condition: > '?:\\Windows\\System32\\SearchProtocolHost.exe', '?:\\Windows\\System32\\svchost.exe', '?:\\Windows\\System32\\sihost.exe', - '?:\\Windows\\System32\\explorer.exe', + '?:\\Windows\\explorer.exe', '?:\\Windows\\System32\\ShellHost.exe', '?:\\Windows\\System32\\FileSyncConfig.exe', '?:\\Windows\\System32\\WorkFolders.exe', '?:\\Windows\\System32\\OneDriveSetup.exe', '?:\\Windows\\SysWOW64\\OneDriveSetup.exe', '?:\\Windows\\SystemApps\\Microsoft.Windows.Search_*\\SearchApp.exe', + '?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe', + '?:\\Program Files\\Microsoft OneDrive\\FileCoAuth.exe', '?:\\Program Files\\Microsoft OneDrive\\*\\OneDrive.exe', '?:\\Program Files\\Microsoft OneDrive\\*\\FileCoAuth.exe', '?:\\Program Files\\Microsoft OneDrive\\*\\OneDriveUpdaterService.exe', @@ -56,7 +58,10 @@ condition: > '?:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe', '?:\\Program Files\\Dropbox\\Client\\Dropbox.exe', '?:\\Program Files\\Adobe\\Adobe Creative Cloud\\ACC\\Creative Cloud.exe', - '?:\\Program Files\\Autodesk\\Desktop App\\AdAppMgrSvc.exe' + '?:\\Program Files\\Autodesk\\Desktop App\\AdAppMgrSvc.exe', + '?:\\Program Files\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe', + '?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe', + '?:\\WINDOWS\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_*\\StartMenuExperienceHost.exe' ) action: - name: kill diff --git a/rules/defense_evasion_direct_disk_device_access.yml b/rules/defense_evasion_direct_disk_device_access.yml index d6f6b233f..446583d15 100644 --- a/rules/defense_evasion_direct_disk_device_access.yml +++ b/rules/defense_evasion_direct_disk_device_access.yml @@ -1,6 +1,6 @@ name: Direct disk device access id: b77914b8-9e91-46ab-8f52-342a2848c59e -version: 1.0.0 +version: 1.0.1 description: | Detects direct access to raw disk devices or volumes by user-mode processes, bypassing the Windows filesystem layer. Attackers abuse raw disk handles to @@ -33,7 +33,9 @@ condition: > ) and ps.exe not imatches ( + '?:\\Windows\\explorer.exe', '?:\\Windows\\System32\\svchost.exe', + '?:\\Windows\\System32\\lsass.exe', '?:\\Windows\\System32\\services.exe', '?:\\Windows\\System32\\defrag.exe', '?:\\Windows\\System32\\chkdsk.exe', @@ -42,6 +44,13 @@ condition: > '?:\\Windows\\System32\\dfrg.msc', '?:\\Windows\\System32\\wbadmin.exe', '?:\\Windows\\System32\\fsutil.exe', + '?:\\Windows\\System32\\MRT.exe', + '?:\\Windows\\System32\\srtasks.exe', + '?:\\Windows\\System32\\taskhostw.exe', + '?:\\Windows\\System32\\wbem\\wmiprvse.exe', + '?:\\Windows\\System32\\SearchIndexer.exe', + '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe', + '?:\\Windows\\System32\\SecurityHealthService.exe', '?:\\Program Files\\VMware\\VMware Workstation\\vmware.exe', '?:\\Program Files (x86)\\VMware\\VMware Workstation\\vmware.exe', '?:\\Program Files\\Oracle\\VirtualBox\\VBoxSVC.exe', @@ -51,9 +60,15 @@ condition: > '?:\\Program Files\\Windows Defender\\MsMpEng.exe', '?:\\Program Files\\Windows Defender\\NisSrv.exe', '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe', - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\NisSrv.exe' - ) + '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\NisSrv.exe', + '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe', + '?:\\WINDOWS\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_*\\StartMenuExperienceHost.exe' + ) and + not (ps.exe imatches '?:\\WINDOWS\\system32\\vssvc.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') and + not (file.path imatches '\\Device\\HarddiskVolume*\\EFI\\OEM\\Boot' and ps.token.integrity_level = 'SYSTEM') and + not (thread.callstack.kernel_summary imatches '*|CI.dll|ntoskrnl.exe|clipsp.sys|*' and ps.signature.trusted = true) and + not (thread.callstack.symbols imatches ('sechost.dll!TraceSetInformation') and ps.signature.trusted = true and ps.signature.subject imatches '*Microsoft Corporation*') severity: high -min-engine-version: 3.0.0 +min-engine-version: 3.1.0 diff --git a/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml b/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml index fa14f3d7e..321dca76b 100644 --- a/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml +++ b/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml @@ -1,6 +1,6 @@ name: .NET assembly loaded by unmanaged process id: 34be8bd1-1143-4fa8-bed4-ae2566b1394a -version: 1.2.0 +version: 1.2.1 description: | Identifies the loading of the .NET assembly by an unmanaged process. Adversaries can load the CLR runtime inside unmanaged process and execute the assembly via the ICLRRuntimeHost::ExecuteInDefaultAppDomain method. @@ -35,21 +35,26 @@ condition: > '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe', '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe', '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe', - '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\WinStore.DesktopExtension\\StoreDesktopExtension.exe' + '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\WinStore.DesktopExtension\\StoreDesktopExtension.exe', + '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxRemoteSession.exe', + '?:\\Program Files\\WindowsApps\\Microsoft*\\MicrosoftSecurityApp\\MicrosoftSecurityApp.exe' ) | |(load_unsigned_or_untrusted_module) and dll.path not imatches ( '?:\\Windows\\System32\\*.dll', - '?:\\Windows\\assembly\\*\\*.ni.dll', + '?:\\Windows\\assembly\\*', '?:\\Program Files\\WindowsPowerShell\\Modules\\*\\*.dll', '?:\\Windows\\Microsoft.NET\\assembly\\*\\*.dll', '?:\\$WinREAgent\\Scratch\\*.dll', '?:\\Windows\\WinSxS\\*.dll', '?:\\Windows\\CbsTemp\\*.dll', '?:\\Windows\\SoftwareDistribution\\*.dll', - '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\*.dll' + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\*.dll', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\*.dll', + '?:\\Program Files\\WindowsApps\\*', + '?:\\Program Files\\dotnet\\shared\\*\\*.dll' ) and ps.exe != '' and ps.pe.is_dotnet = false and (dll.pe.is_dotnet or thread.callstack.modules imatches ('*clr.dll')) diff --git a/rules/defense_evasion_hidden_registry_key_creation.yml b/rules/defense_evasion_hidden_registry_key_creation.yml index ebc48939d..cac9528f6 100644 --- a/rules/defense_evasion_hidden_registry_key_creation.yml +++ b/rules/defense_evasion_hidden_registry_key_creation.yml @@ -1,6 +1,6 @@ name: Hidden registry key creation id: 65deda38-9b1d-42a0-9f40-a68903e81b49 -version: 1.1.7 +version: 1.1.8 description: | Identifies the creation of a hidden registry key. Adversaries can utilize the native NtSetValueKey API to create a hidden registry key and conceal payloads @@ -31,13 +31,15 @@ condition: > '?:\\Windows\\System32\\svchost.exe', '?:\\Windows\\WinSxS\\*\\TiWorker.exe', '?:\\Windows\\UUS\\*\\wuaucltcore.exe', - '?:\\$WinREAgent\\Scratch\\*\\DismHost.exe' + '?:\\$WinREAgent\\Scratch\\*\\DismHost.exe', + '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\containerworker.exe' ) and ps.parent.exe not imatches ( '?:\\WINDOWS\\uus\\*\\wuaucltcore.exe', '?:\\WINDOWS\\System32\\svchost.exe' - ) + ) and + not (ps.exe imatches '?:\\Windows\\*' and thread.callstack.summary imatches ('ntdll.dll|wcp.dll|CbsCore.dll|turbostsack.dll|*', 'ntdll.dll|drvstore.dll|drupdate.dll|CbsCore.dll|turbostsack.dll|*')) output: > Hidden registry key %registry.path created by process %ps.exe diff --git a/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml b/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml index 0e61f6819..188abdbcb 100644 --- a/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml +++ b/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml @@ -1,6 +1,6 @@ name: Potential process injection via tainted memory section id: 8e4182f3-02e7-4e95-afc3-93d18c9a9c09 -version: 1.0.6 +version: 1.0.8 description: | Identifies potential process injection when the adversary creates and maps a memory section with RW protection rights followed by mapping of the same memory section in @@ -38,8 +38,14 @@ condition: > '?:\\WINDOWS\\System32\\lsass.exe', '?:\\WINDOWS\\System32\\SecurityHealthService.exe', '?:\\WINDOWS\\System32\\services.exe', - '?:\\WINDOWS\\System32\\RuntimeBroker.exe' - ) + '?:\\WINDOWS\\System32\\RuntimeBroker.exe', + '?:\\WINDOWS\\System32\\sihost.exe', + '?:\\WINDOWS\\System32\\smartscreen.exe', + '?:\\WINDOWS\\System32\\taskhostw.exe', + '?:\\WINDOWS\\System32\\wbem\\wmiprvse.exe', + '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe' + ) and + not (ps.parent.exe imatches '?:\\WINDOWS\\Explorer.exe' and ps.signature.exists = true and ps.signature.trusted = true) | as e1 |map_view_of_section and file.view.protection = 'READONLY|EXECUTE' and file.key = $e1.file.key and evt.pid != $e1.evt.pid| action: diff --git a/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml b/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml index f3fa84996..b9e3f2374 100644 --- a/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml +++ b/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml @@ -1,6 +1,6 @@ name: Process execution from hollowed memory section id: 2a3fbae8-5e8c-4b71-b9da-56c3958c0d53 -version: 2.1.3 +version: 2.1.4 description: | Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code @@ -32,7 +32,9 @@ condition: > '?:\\Windows\\System32\\services.exe', '?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe', '?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe' - ) + ) and + not (ps.exe imatches '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxServer.exe' and ps.parent.exe imatches '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxRemoteSession.exe') and + not (ps.exe imatches '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxRemoteSession.exe' and ps.parent.exe imatches '?:\\Windows\\explorer.exe') | by ps.uuid, file.view.base |load_executable and module.path not imatches '?:\\Windows\\SoftwareDistribution\\Download\\*\\Package_for_RollupFix*\\*.exe' and diff --git a/rules/defense_evasion_process_execution_from_self_deleting_binary.yml b/rules/defense_evasion_process_execution_from_self_deleting_binary.yml index c82042e2f..cc5ac8c62 100644 --- a/rules/defense_evasion_process_execution_from_self_deleting_binary.yml +++ b/rules/defense_evasion_process_execution_from_self_deleting_binary.yml @@ -1,6 +1,6 @@ name: Process execution from a self-deleting binary id: 0f0da517-b22c-4d14-9adc-36baeb621cf7 -version: 1.0.6 +version: 1.0.7 description: | Identifies the execution of the process from a self-deleting binary. The attackers can abuse undocumented API functions to create a process from a file-backed section. The file @@ -19,7 +19,7 @@ references: condition: > sequence - maxspan 1m + maxspan 1m |delete_file and file.info.is_disposition_delete_file and ps.exe not imatches @@ -29,7 +29,8 @@ condition: > '?:\\WINDOWS\\uus\\packages\\preview\\*\\MoUsoCoreWorker.exe', '?:\\WINDOWS\\System32\\svchost.exe', '?:\\WINDOWS\\winsxs\\*\\TiWorker.exe', - '?:\\Windows\\UUS\\*\\wuaucltcore.exe' + '?:\\Windows\\UUS\\*\\wuaucltcore.exe', + '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\containerworker.exe' ) and ps.parent.exe not imatches '?:\\WINDOWS\\uus\\*\\wuaucltcore.exe' and file.path not imatches diff --git a/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml b/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml index cf7d6ac9e..d00fc142d 100644 --- a/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml +++ b/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml @@ -1,6 +1,6 @@ name: Suspicious access to the hosts file id: f7b2c9d3-99e7-41d5-bb4a-6ea1a5f7f9e2 -version: 1.1.0 +version: 1.1.1 description: > Identifies suspicious process accessing the Windows hosts file for potential tampering. Adversaries can hijack the hosts files to block traffic to download/update servers or redirect the @@ -51,7 +51,8 @@ condition: > '?:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\*\\Smc.exe', '?:\\Program Files (x86)\\Trend Micro\\*\\TMBMSRV.exe', '?:\\Program Files\\ESET\\ESET Security\\ekrn.exe', - '?:\\Program Files\\Sophos\\Sophos Anti-Virus\\SavService.exe' + '?:\\Program Files\\Sophos\\Sophos Anti-Virus\\SavService.exe', + '?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF\\AcroCEF.exe' ) | |open_file and @@ -61,11 +62,14 @@ condition: > '?:\\Program Files\\*\\libcef.dll!GetHandleVerifier', '?:\\Program Files (x86)\\*\\libcef.dll!GetHandleVerifier', '?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe!GetHandleVerifier', + '?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe!uv_tcp_init', '?:\\Users\\*\\AppData\\Roaming\\Spotify\\libcef.dll!GetHandleVerifier', '?:\\Program Files\\Microsoft VS Code\\Code.exe!GetHandleVerifier', '?:\\Program Files (x86)\\Microsoft VS Code\\Code.exe!GetHandleVerifier', '?:\\Program Files\\Google\\Chrome\\*\\chrome.dll!*', - '?:\\Program Files (x86)\\Google\\Chrome\\*\\chrome.dll!*' + '?:\\Program Files (x86)\\Google\\Chrome\\*\\chrome.dll!*', + '?:\\Program Files\\Microsoft\\*\\msedge.dll!*', + '?:\\Program Files (x86)\\Microsoft\\*\\msedge.dll!*' )) | action: diff --git a/rules/defense_evasion_suspicious_protected_process_execution.yml b/rules/defense_evasion_suspicious_protected_process_execution.yml index a360e5952..21e3a7644 100644 --- a/rules/defense_evasion_suspicious_protected_process_execution.yml +++ b/rules/defense_evasion_suspicious_protected_process_execution.yml @@ -1,6 +1,6 @@ name: Suspicious protected process execution id: a778295a-02f1-42d9-9c20-78346a7bc2c6 -version: 1.0.0 +version: 1.1.0 description: | Identifies unprivileged process spawning a child with protected integrity level. This indicates an unusual behavior that is often associated with attempts to tamper with or @@ -22,12 +22,15 @@ condition: > sequence maxspan 1m30s |spawn_process and - ps.token.integrity_level != 'SYSTEM' and + ps.is_protected = false and + (ps.sid != 'S-1-5-18' or ps.token.integrity_level != 'SYSTEM') and ps.exe not imatches ( '?:\\Program Files\\*', - '?:\\Program Files(x86)\\*' - ) + '?:\\Program Files(x86)\\*', + '?:\\WINDOWS\\System32\\csrss.exe' + ) and + ps.parent.exe not imatches '?:\\WINDOWS\\System32\\smss.exe' | by ps.uuid |spawn_process and ps.is_protected| by ps.parent.uuid action: diff --git a/rules/execution_embedded_script_execution_via_shortcut_file.yml b/rules/execution_embedded_script_execution_via_shortcut_file.yml index df041e05b..e91d6b6d5 100644 --- a/rules/execution_embedded_script_execution_via_shortcut_file.yml +++ b/rules/execution_embedded_script_execution_via_shortcut_file.yml @@ -1,6 +1,6 @@ name: Embedded script execution via shortcut file id: 2d94a68b-03fe-4ece-9a99-f4de8ff7261d -version: 1.0.1 +version: 1.0.2 description: | Detects execution of embedded scripts delivered via Windows shortcut (.lnk) files. Adversaries can exploit the attack chain where a shortcut file is accessed by a @@ -26,7 +26,8 @@ condition: > by ps.sessionid |open_file and ps.name iin ('cmd.exe', 'findstr.exe', 'find.exe', 'powershell.exe', 'pwsh.exe') and - file.path imatches '?:\\*.lnk' + file.path imatches '?:\\*.lnk' and + file.path not imatches '?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Powershell\\Windows PowerShell.lnk' | |create_file and ps.name iin ('cmd.exe', 'powershell.exe', 'pwsh.exe') and diff --git a/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml b/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml index b672f791d..4a7c015dd 100644 --- a/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml +++ b/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml @@ -1,6 +1,6 @@ name: Clickfix phishing via browser dialog box id: 5fc4bf43-fbb6-4a78-a2cc-1fe9138bd3c2 -version: 1.0.0 +version: 1.0.1 description: | Identifies a ClickFix-style social-engineering phishing attempt and its FileFix evolution where a web page coerces a user into interacting with a trusted File Explorer address bar so @@ -23,6 +23,7 @@ references: condition: > spawn_process and ps.parent.name iin web_browser_binaries and + (ps.parent.args iintersects ('--service-sandbox-type=none', '--message-loop-type-ui') or ps.parent.args iintersects ('-contentproc', 'utility')) and (ps.name iin script_interpreters or ps.name iin ('msiexec.exe', 'rundll32.exe', 'curl.exe', 'wget.exe', 'certutil.exe', 'certreq.exe', 'msbuild.exe') or ps.exe imatches '?:\\Users\\*\\Downloads\\*') and thread.callstack.summary imatches 'ntdll.dll|*|windows.storage.dll|shell32.dll|windows.storage.dll|SHCore.dll|*' diff --git a/rules/privilege_escalation_suspicious_child_process_integrity_level.yml b/rules/privilege_escalation_suspicious_child_process_integrity_level.yml index 90ebae1b7..782e2ab50 100644 --- a/rules/privilege_escalation_suspicious_child_process_integrity_level.yml +++ b/rules/privilege_escalation_suspicious_child_process_integrity_level.yml @@ -1,6 +1,6 @@ name: Suspicious child process integrity level id: b958e949-a16a-4d66-b008-15f4e8382a6e -version: 1.0.1 +version: 1.0.2 description: | Identifies the execution of the parent process running with low/medium integrity level that spawns a child process with the system integrity level. Because normal @@ -41,7 +41,8 @@ condition: > '?:\\Windows\\System32\\WerFaultSecure.exe', '?:\\Program Files\\Google\\GoogleUpdater\\*\\updater.exe', '?:\\Program Files (x86)\\Google\\GoogleUpdater\\*\\updater.exe' - ) + ) and + not (ps.exe imatches '?:\\WINDOWS\\system32\\conhost.exe' and ps.parent.exe imatches '?:\\WINDOWS\\system32\\Clipup.exe') | by ps.parent.uuid action: - name: kill