add SIGMA rule adjust WELA Framwork #28

Yamato-Security · Sep 4, 2021 · aa256da · aa256da
1 parent 2cffec8
commit aa256da
Show file tree

Hide file tree

Showing 9 changed files with 254 additions and 0 deletions.
diff --git a/Rules/SIGMA/RuleTemplate.ps1template b/Rules/SIGMA/RuleTemplate.ps1template
@@ -0,0 +1,28 @@
+
+
+function Add-Rule {
+    param (
+        [bool] $isLiveAnalysis
+    )
+    $ruleName = "!filename!";
+    $detectedMessage = "!detection!"
+
+    $detectRule = {
+        function Search-DetectableEvents {
+            param (
+                $event
+            )
+
+            $result = $event !firstpipe!;
+            if ($result.Count -ne 0) {
+                Write-Host
+                Write-Host "Detected! RuleName:$ruleName"  
+                Write-Host
+                Write-Host $detectedMessage;
+            }
+
+        };
+        Search-DetectableEvents $args[0];
+    };
+    $Global:ruleStack.Add($ruleName, $detectRule);
+}
diff --git a/Rules/SIGMA/av_password_dumper.ps1 b/Rules/SIGMA/av_password_dumper.ps1
@@ -0,0 +1,28 @@
+# Get-WinEvent | where {($_.message -match "Signature.*.*DumpCreds.*" -or $_.message -match "Signature.*.*Mimikatz.*" -or $_.message -match "Signature.*.*PWCrack.*" -or $_.message -match "Signature.*.*HTool/WCE.*" -or $_.message -match "Signature.*.*PSWtool.*" -or $_.message -match "Signature.*.*PWDump.*" -or $_.message -match "Signature.*.*SecurityTool.*" -or $_.message -match "Signature.*.*PShlSpy.*" -or $_.message -match "Signature.*.*Rubeus.*" -or $_.message -match "Signature.*.*Kekeo.*" -or $_.message -match "Signature.*.*LsassDump.*" -or $_.message -match "Signature.*.*Outflank.*") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message
+
+function Add-Rule {
+    param (
+        [bool] $isLiveAnalysis
+    )
+    $ruleName = "av_password_dumper";
+    $detectedMessage = "Detects a highly relevant Antivirus alert that reports a password dumper."
+
+    $detectRule = {
+        function Search-DetectableEvents {
+            param (
+                $event
+            )
+
+            $result = $event | where { ($_.message -match "Signature.*.*DumpCreds.*" -or $_.message -match "Signature.*.*Mimikatz.*" -or $_.message -match "Signature.*.*PWCrack.*" -or $_.message -match "Signature.*.*HTool/WCE.*" -or $_.message -match "Signature.*.*PSWtool.*" -or $_.message -match "Signature.*.*PWDump.*" -or $_.message -match "Signature.*.*SecurityTool.*" -or $_.message -match "Signature.*.*PShlSpy.*" -or $_.message -match "Signature.*.*Rubeus.*" -or $_.message -match "Signature.*.*Kekeo.*" -or $_.message -match "Signature.*.*LsassDump.*" -or $_.message -match "Signature.*.*Outflank.*") } | select TimeCreated, Id, RecordId, ProcessId, MachineName, Message;
+            if ($result.Count -ne 0) {
+                Write-Host
+                Write-Host "Detected! RuleName:$ruleName"  
+                Write-Host
+                Write-Host $detectedMessage;
+            }
+
+        };
+        Search-DetectableEvents $args[0];
+    };
+    $Global:ruleStack.Add($ruleName, $detectRule);
+}
diff --git a/Rules/SIGMA/av_printernightmare_cve_2021_34527.ps1 b/Rules/SIGMA/av_printernightmare_cve_2021_34527.ps1
@@ -0,0 +1,29 @@
+# Get-WinEvent | where {$_.message -match "FileName.*.*C:\\Windows\\System32\\spool\\drivers\\x64\\.*" } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message
+
+
+function Add-Rule {
+    param (
+        [bool] $isLiveAnalysis
+    )
+    $ruleName = "av_printernightmare_cve_2021_34527";
+    $detectedMessage = "Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 ."
+
+    $detectRule = {
+        function Search-DetectableEvents {
+            param (
+                $event
+            )
+
+            $result = $event | where { $_.message -match "FileName.*.*C:\\Windows\\System32\\spool\\drivers\\x64\\.*" } | select TimeCreated, Id, RecordId, ProcessId, MachineName, Message;
+            if ($result.Count -ne 0) {
+                Write-Host
+                Write-Host "Detected! RuleName:$ruleName"  
+                Write-Host
+                Write-Host $detectedMessage;
+            }
+
+        };
+        Search-DetectableEvents $args[0];
+    };
+    $Global:ruleStack.Add($ruleName, $detectRule);
+}
diff --git a/Rules/SIGMA/av_relevant_files.ps1 b/Rules/SIGMA/av_relevant_files.ps1
@@ -0,0 +1,29 @@
+# Get-WinEvent | where {(($_.message -match "FileName.*C:\\Windows\\.*" -or $_.message -match "FileName.*C:\\Temp\\.*" -or $_.message -match "FileName.*C:\\PerfLogs\\.*" -or $_.message -match "FileName.*C:\\Users\\Public\\.*" -or $_.message -match "FileName.*C:\\Users\\Default\\.*") -or ($_.message -match "FileName.*.*\\Client\\.*" -or $_.message -match "FileName.*.*\\tsclient\\.*" -or $_.message -match "FileName.*.*\\inetpub\\.*" -or $_.message -match "FileName.*.*/www/.*" -or $_.message -match "FileName.*.*apache.*" -or $_.message -match "FileName.*.*tomcat.*" -or $_.message -match "FileName.*.*nginx.*" -or $_.message -match "FileName.*.*weblogic.*") -or ($_.message -match "Filename.*.*.ps1" -or $_.message -match "Filename.*.*.psm1" -or $_.message -match "Filename.*.*.vbs" -or $_.message -match "Filename.*.*.bat" -or $_.message -match "Filename.*.*.cmd" -or $_.message -match "Filename.*.*.sh" -or $_.message -match "Filename.*.*.chm" -or $_.message -match "Filename.*.*.xml" -or $_.message -match "Filename.*.*.txt" -or $_.message -match "Filename.*.*.jsp" -or $_.message -match "Filename.*.*.jspx" -or $_.message -match "Filename.*.*.asp" -or $_.message -match "Filename.*.*.aspx" -or $_.message -match "Filename.*.*.ashx" -or $_.message -match "Filename.*.*.asax" -or $_.message -match "Filename.*.*.asmx" -or $_.message -match "Filename.*.*.php" -or $_.message -match "Filename.*.*.cfm" -or $_.message -match "Filename.*.*.py" -or $_.message -match "Filename.*.*.pyc" -or $_.message -match "Filename.*.*.pl" -or $_.message -match "Filename.*.*.rb" -or $_.message -match "Filename.*.*.cgi" -or $_.message -match "Filename.*.*.war" -or $_.message -match "Filename.*.*.ear" -or $_.message -match "Filename.*.*.hta" -or $_.message -match "Filename.*.*.lnk" -or $_.message -match "Filename.*.*.scf" -or $_.message -match "Filename.*.*.sct" -or $_.message -match "Filename.*.*.vbe" -or $_.message -match "Filename.*.*.wsf" -or $_.message -match "Filename.*.*.wsh" -or $_.message -match "Filename.*.*.gif" -or $_.message -match "Filename.*.*.png" -or $_.message -match "Filename.*.*.jpg" -or $_.message -match "Filename.*.*.jpeg" -or $_.message -match "Filename.*.*.svg" -or $_.message -match "Filename.*.*.dat")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message
+
+
+function Add-Rule {
+    param (
+        [bool] $isLiveAnalysis
+    )
+    $ruleName = "av_relevant_files";
+    $detectedMessage = "Detects an Antivirus alert in a highly relevant file path or with a relevant file name."
+
+    $detectRule = {
+        function Search-DetectableEvents {
+            param (
+                $event
+            )
+
+            $result = $event | where { (($_.message -match "FileName.*C:\\Windows\\.*" -or $_.message -match "FileName.*C:\\Temp\\.*" -or $_.message -match "FileName.*C:\\PerfLogs\\.*" -or $_.message -match "FileName.*C:\\Users\\Public\\.*" -or $_.message -match "FileName.*C:\\Users\\Default\\.*") -or ($_.message -match "FileName.*.*\\Client\\.*" -or $_.message -match "FileName.*.*\\tsclient\\.*" -or $_.message -match "FileName.*.*\\inetpub\\.*" -or $_.message -match "FileName.*.*/www/.*" -or $_.message -match "FileName.*.*apache.*" -or $_.message -match "FileName.*.*tomcat.*" -or $_.message -match "FileName.*.*nginx.*" -or $_.message -match "FileName.*.*weblogic.*") -or ($_.message -match "Filename.*.*.ps1" -or $_.message -match "Filename.*.*.psm1" -or $_.message -match "Filename.*.*.vbs" -or $_.message -match "Filename.*.*.bat" -or $_.message -match "Filename.*.*.cmd" -or $_.message -match "Filename.*.*.sh" -or $_.message -match "Filename.*.*.chm" -or $_.message -match "Filename.*.*.xml" -or $_.message -match "Filename.*.*.txt" -or $_.message -match "Filename.*.*.jsp" -or $_.message -match "Filename.*.*.jspx" -or $_.message -match "Filename.*.*.asp" -or $_.message -match "Filename.*.*.aspx" -or $_.message -match "Filename.*.*.ashx" -or $_.message -match "Filename.*.*.asax" -or $_.message -match "Filename.*.*.asmx" -or $_.message -match "Filename.*.*.php" -or $_.message -match "Filename.*.*.cfm" -or $_.message -match "Filename.*.*.py" -or $_.message -match "Filename.*.*.pyc" -or $_.message -match "Filename.*.*.pl" -or $_.message -match "Filename.*.*.rb" -or $_.message -match "Filename.*.*.cgi" -or $_.message -match "Filename.*.*.war" -or $_.message -match "Filename.*.*.ear" -or $_.message -match "Filename.*.*.hta" -or $_.message -match "Filename.*.*.lnk" -or $_.message -match "Filename.*.*.scf" -or $_.message -match "Filename.*.*.sct" -or $_.message -match "Filename.*.*.vbe" -or $_.message -match "Filename.*.*.wsf" -or $_.message -match "Filename.*.*.wsh" -or $_.message -match "Filename.*.*.gif" -or $_.message -match "Filename.*.*.png" -or $_.message -match "Filename.*.*.jpg" -or $_.message -match "Filename.*.*.jpeg" -or $_.message -match "Filename.*.*.svg" -or $_.message -match "Filename.*.*.dat")) } | select TimeCreated, Id, RecordId, ProcessId, MachineName, Message;
+            if ($result.Count -ne 0) {
+                Write-Host
+                Write-Host "Detected! RuleName:$ruleName"  
+                Write-Host
+                Write-Host $detectedMessage;
+            }
+
+        };
+        Search-DetectableEvents $args[0];
+    };
+    $Global:ruleStack.Add($ruleName, $detectRule);
+}
diff --git a/Rules/SIGMA/av_webshell.ps1 b/Rules/SIGMA/av_webshell.ps1
@@ -0,0 +1,28 @@
+#Get-WinEvent | where {(($_.message -match "Signature.*PHP/.*" -or $_.message -match "Signature.*JSP/.*" -or $_.message -match "Signature.*ASP/.*" -or $_.message -match "Signature.*Perl/.*" -or $_.message -match "Signature.*PHP..*" -or $_.message -match "Signature.*JSP..*" -or $_.message -match "Signature.*ASP..*" -or $_.message -match "Signature.*Perl..*" -or $_.message -match "Signature.*VBS/Uxor.*" -or $_.message -match "Signature.*IIS/BackDoor.*" -or $_.message -match "Signature.*JAVA/Backdoor.*" -or $_.message -match "Signature.*Troj/ASP.*" -or $_.message -match "Signature.*Troj/PHP.*" -or $_.message -match "Signature.*Troj/JSP.*") -or ($_.message -match "Signature.*.*Webshell.*" -or $_.message -match "Signature.*.*Chopper.*" -or $_.message -match "Signature.*.*SinoChoper.*" -or $_.message -match "Signature.*.*ASPXSpy.*" -or $_.message -match "Signature.*.*Aspdoor.*" -or $_.message -match "Signature.*.*filebrowser.*" -or $_.message -match "Signature.*.*PHP_.*" -or $_.message -match "Signature.*.*JSP_.*" -or $_.message -match "Signature.*.*ASP_.*" -or $_.message -match "Signature.*.*PHP:.*" -or $_.message -match "Signature.*.*JSP:.*" -or $_.message -match "Signature.*.*ASP:.*" -or $_.message -match "Signature.*.*Perl:.*" -or $_.message -match "Signature.*.*PHPShell.*" -or $_.message -match "Signature.*.*Trojan.PHP.*" -or $_.message -match "Signature.*.*Trojan.ASP.*" -or $_.message -match "Signature.*.*Trojan.JSP.*" -or $_.message -match "Signature.*.*Trojan.VBS.*" -or $_.message -match "Signature.*.*PHP?Agent.*" -or $_.message -match "Signature.*.*ASP?Agent.*" -or $_.message -match "Signature.*.*JSP?Agent.*" -or $_.message -match "Signature.*.*VBS?Agent.*" -or $_.message -match "Signature.*.*Backdoor?PHP.*" -or $_.message -match "Signature.*.*Backdoor?JSP.*" -or $_.message -match "Signature.*.*Backdoor?ASP.*" -or $_.message -match "Signature.*.*Backdoor?VBS.*" -or $_.message -match "Signature.*.*Backdoor?Java.*")) } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message
+
+function Add-Rule {
+    param (
+        [bool] $isLiveAnalysis
+    )
+    $ruleName = "av_webshell";
+    $detectedMessage = " Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big webshell repo from e.g. github and checking the matches."
+
+    $detectRule = {
+        function Search-DetectableEvents {
+            param (
+                $event
+            )
+
+            $result = $event | where { (($_.message -match "Signature.*PHP/.*" -or $_.message -match "Signature.*JSP/.*" -or $_.message -match "Signature.*ASP/.*" -or $_.message -match "Signature.*Perl/.*" -or $_.message -match "Signature.*PHP..*" -or $_.message -match "Signature.*JSP..*" -or $_.message -match "Signature.*ASP..*" -or $_.message -match "Signature.*Perl..*" -or $_.message -match "Signature.*VBS/Uxor.*" -or $_.message -match "Signature.*IIS/BackDoor.*" -or $_.message -match "Signature.*JAVA/Backdoor.*" -or $_.message -match "Signature.*Troj/ASP.*" -or $_.message -match "Signature.*Troj/PHP.*" -or $_.message -match "Signature.*Troj/JSP.*") -or ($_.message -match "Signature.*.*Webshell.*" -or $_.message -match "Signature.*.*Chopper.*" -or $_.message -match "Signature.*.*SinoChoper.*" -or $_.message -match "Signature.*.*ASPXSpy.*" -or $_.message -match "Signature.*.*Aspdoor.*" -or $_.message -match "Signature.*.*filebrowser.*" -or $_.message -match "Signature.*.*PHP_.*" -or $_.message -match "Signature.*.*JSP_.*" -or $_.message -match "Signature.*.*ASP_.*" -or $_.message -match "Signature.*.*PHP:.*" -or $_.message -match "Signature.*.*JSP:.*" -or $_.message -match "Signature.*.*ASP:.*" -or $_.message -match "Signature.*.*Perl:.*" -or $_.message -match "Signature.*.*PHPShell.*" -or $_.message -match "Signature.*.*Trojan.PHP.*" -or $_.message -match "Signature.*.*Trojan.ASP.*" -or $_.message -match "Signature.*.*Trojan.JSP.*" -or $_.message -match "Signature.*.*Trojan.VBS.*" -or $_.message -match "Signature.*.*PHP?Agent.*" -or $_.message -match "Signature.*.*ASP?Agent.*" -or $_.message -match "Signature.*.*JSP?Agent.*" -or $_.message -match "Signature.*.*VBS?Agent.*" -or $_.message -match "Signature.*.*Backdoor?PHP.*" -or $_.message -match "Signature.*.*Backdoor?JSP.*" -or $_.message -match "Signature.*.*Backdoor?ASP.*" -or $_.message -match "Signature.*.*Backdoor?VBS.*" -or $_.message -match "Signature.*.*Backdoor?Java.*")) } | select TimeCreated, Id, RecordId, ProcessId, MachineName, Message;
+            if ($result.Count -ne 0) {
+                Write-Host
+                Write-Host "Detected! RuleName:$ruleName"  
+                Write-Host
+                Write-Host $detectedMessage;
+            }
+
+        };
+        Search-DetectableEvents $args[0];
+    };
+    $Global:ruleStack.Add($ruleName, $detectRule);
+}
diff --git a/Rules/SIGMA/dns_mega_nz.ps1 b/Rules/SIGMA/dns_mega_nz.ps1
@@ -0,0 +1,28 @@
+# Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational | where {($_.ID -eq "22" -and $_.message -match "QueryName.*.*userstorage.mega.co.nz.*") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message
+
+function Add-Rule {
+    param (
+        [bool] $isLiveAnalysis
+    )
+    $ruleName = "dns_mega_nz";
+    $detectedMessage = " Detects DNS queries for subdomains used for upload to MEGA.io"
+
+    $detectRule = {
+        function Search-DetectableEvents {
+            param (
+                $event
+            )
+
+            $result = $event | where { ($_.ID -eq "22" -and $_.message -match "QueryName.*.*userstorage.mega.co.nz.*") } | select TimeCreated, Id, RecordId, ProcessId, MachineName, Message;
+            if ($result.Count -ne 0) {
+                Write-Host
+                Write-Host "Detected! RuleName:$ruleName"  
+                Write-Host
+                Write-Host $detectedMessage;
+            }
+
+        };
+        Search-DetectableEvents $args[0];
+    };
+    $Global:ruleStack.Add($ruleName, $detectRule);
+}
diff --git a/Rules/SIGMA/mal_azorult_reg.ps1 b/Rules/SIGMA/mal_azorult_reg.ps1
@@ -0,0 +1,28 @@
+#Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational | where {(($_.ID -eq "12" -or $_.ID -eq "13" -or $_.ID -eq "14") -and ($_.ID -eq "12" -or $_.ID -eq "13") -and $_.message -match "TargetObject.*.*SYSTEM\\.*" -and $_.message -match "TargetObject.*.*\\services\\localNETService") } | select TimeCreated,Id,RecordId,ProcessId,MachineName,Message
+
+function Add-Rule {
+    param (
+        [bool] $isLiveAnalysis
+    )
+    $ruleName = "mal_azorult_reg";
+    $detectedMessage = " Detects the presence of a registry key created during Azorult execution"
+
+    $detectRule = {
+        function Search-DetectableEvents {
+            param (
+                $event
+            )
+
+            $result = $event | where { (($_.ID -eq "12" -or $_.ID -eq "13" -or $_.ID -eq "14") -and ($_.ID -eq "12" -or $_.ID -eq "13") -and $_.message -match "TargetObject.*.*SYSTEM\\.*" -and $_.message -match "TargetObject.*.*\\services\\localNETService") } | select TimeCreated, Id, RecordId, ProcessId, MachineName, Message;
+            if ($result.Count -ne 0) {
+                Write-Host
+                Write-Host "Detected! RuleName:$ruleName"  
+                Write-Host
+                Write-Host $detectedMessage;
+            }
+
+        };
+        Search-DetectableEvents $args[0];
+    };
+    $Global:ruleStack.Add($ruleName, $detectRule);
+}