Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] Windows DR Tuning - 14 #3376

Merged
merged 5 commits into from
Jan 15, 2024
Merged

[Rule Tuning] Windows DR Tuning - 14 #3376

merged 5 commits into from
Jan 15, 2024

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Jan 9, 2024

Issues

Part of #3186

Summary

Tunes the following rules:

  • Component Object Model Hijacking
  • Potential Persistence via Time Provider Modification
  • Web Shell Detection: Script Process Child of Common Web Processes
  • Expired or Revoked Driver Loaded
  • Suspicious PrintSpooler Service Executable File Creation

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint labels Jan 9, 2024
@w0rk3r w0rk3r self-assigned this Jan 9, 2024
@w0rk3r w0rk3r mentioned this pull request Jan 9, 2024
Closed
w0rk3r
w0rk3r commented Jan 9, 2024
View reviewed changes
rules/windows/persistence_suspicious_com_hijack_registry.toml
@@ -13,7 +13,7 @@ Identifies Component Object Model (COM) hijacking via registry modification. Adv
executing malicious content triggered by hijacked references to COM objects.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "endgame-*"]
index = ["logs-endpoint.events.*"]
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed Endgame support to check signer info; Endgame doesn't have this data outside process events.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call

rules/windows/persistence_suspicious_com_hijack_registry.toml
Comment on lines +109 to +122
process.name : "svchost.exe" and
process.code_signature.trusted == true and process.code_signature.subject_name == "Microsoft Windows Publisher" and
registry.value : "DelegateExecute" and
registry.data.strings : (
/* https://strontic.github.io/xcyclopedia/library/clsid_4ED3A719-CEA8-4BD9-910D-E252F997AFC2.html */
"{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}",

/* https://strontic.github.io/xcyclopedia/library/clsid_A56A841F-E974-45C1-8001-7E3F8A085917.html */
"{A56A841F-E974-45C1-8001-7E3F8A085917}",

/* https://strontic.github.io/xcyclopedia/library/clsid_BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78.html */
"{BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78}",
"%SystemRoot%\\system32\\shdocvw.dll"
)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A second 👀 to confirm if we can exclude those would be nice.

Cc @Samirbous

rules/windows/privilege_escalation_expired_driver_loaded.toml
rule_id = "d12bac54-ab2a-4159-933f-d7bcefa7b61d"
severity = "low"
severity = "medium"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Low volume, bumping severity

rules/windows/privilege_escalation_printspooler_service_suspicious_file.toml
"?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\*.dll",
"?:\\WINDOWS\\system32\\spool\\DRIVERS\\W32X86\\*.dll",
"?:\\WINDOWS\\system32\\spool\\PRTPROCS\\x64\\*.dll",
"?:\\WINDOWS\\system32\\spool\\{????????-????-????-????-????????????}\\*.dll"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Super high volume (>900k events last 90d), ?s cover the GUID format

Aegrah
Aegrah approved these changes Jan 10, 2024
View reviewed changes
Copy link
Contributor

@Aegrah Aegrah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work. Glad to see the component object model hijacking rule receive some good tuning!

terrancedejesus
terrancedejesus reviewed Jan 12, 2024
View reviewed changes
rules/windows/persistence_suspicious_com_hijack_registry.toml
registry.path : ("HK*\\InprocServer32\\", "\\REGISTRY\\*\\InprocServer32\\") and
registry.data.strings: ("scrobj.dll", "C:\\*\\scrobj.dll") and
registry.path : "HK*\\InprocServer32\\" and
registry.data.strings: ("scrobj.dll", "?:\\*\\scrobj.dll") and
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Almost feel like we should audit all Windows rules and check for this.

terrancedejesus
terrancedejesus approved these changes Jan 12, 2024
View reviewed changes
Copy link
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great stuff!

@w0rk3r w0rk3r merged commit 0469785 into main Jan 15, 2024
13 checks passed
@w0rk3r w0rk3r deleted the rt_14 branch January 15, 2024 14:16
protectionsmachine pushed a commit that referenced this pull request Jan 15, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 14 (#3376)
6931869 
* [Rule Tuning] Windows DR Tuning - 14

* Update persistence_suspicious_com_hijack_registry.toml

* Update rules/windows/persistence_webshell_detection.toml

(cherry picked from commit 0469785)
protectionsmachine pushed a commit that referenced this pull request Jan 15, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 14 (#3376)
e0c9b0a 
* [Rule Tuning] Windows DR Tuning - 14

* Update persistence_suspicious_com_hijack_registry.toml

* Update rules/windows/persistence_webshell_detection.toml

(cherry picked from commit 0469785)
protectionsmachine pushed a commit that referenced this pull request Jan 15, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 14 (#3376)
184bd79 
* [Rule Tuning] Windows DR Tuning - 14

* Update persistence_suspicious_com_hijack_registry.toml

* Update rules/windows/persistence_webshell_detection.toml

(cherry picked from commit 0469785)
protectionsmachine pushed a commit that referenced this pull request Jan 15, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 14 (#3376)
af31d0d 
* [Rule Tuning] Windows DR Tuning - 14

* Update persistence_suspicious_com_hijack_registry.toml

* Update rules/windows/persistence_webshell_detection.toml

(cherry picked from commit 0469785)
protectionsmachine pushed a commit that referenced this pull request Jan 15, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 14 (#3376)
cb4954a 
* [Rule Tuning] Windows DR Tuning - 14

* Update persistence_suspicious_com_hijack_registry.toml

* Update rules/windows/persistence_webshell_detection.toml

(cherry picked from commit 0469785)
protectionsmachine pushed a commit that referenced this pull request Jan 15, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 14 (#3376)
ff2a106 
* [Rule Tuning] Windows DR Tuning - 14

* Update persistence_suspicious_com_hijack_registry.toml

* Update rules/windows/persistence_webshell_detection.toml

(cherry picked from commit 0469785)
protectionsmachine pushed a commit that referenced this pull request Jan 15, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 14 (#3376)
d7dbd23 
* [Rule Tuning] Windows DR Tuning - 14

* Update persistence_suspicious_com_hijack_registry.toml

* Update rules/windows/persistence_webshell_detection.toml

(cherry picked from commit 0469785)
protectionsmachine pushed a commit that referenced this pull request Jan 15, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 14 (#3376)
753578f 
* [Rule Tuning] Windows DR Tuning - 14

* Update persistence_suspicious_com_hijack_registry.toml

* Update rules/windows/persistence_webshell_detection.toml

(cherry picked from commit 0469785)
protectionsmachine pushed a commit that referenced this pull request Jan 15, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 14 (#3376)
15e3f18 
* [Rule Tuning] Windows DR Tuning - 14

* Update persistence_suspicious_com_hijack_registry.toml

* Update rules/windows/persistence_webshell_detection.toml

(cherry picked from commit 0469785)
protectionsmachine pushed a commit that referenced this pull request Jan 15, 2024
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 14 (#3376)
da6d4cd 
* [Rule Tuning] Windows DR Tuning - 14

* Update persistence_suspicious_com_hijack_registry.toml

* Update rules/windows/persistence_webshell_detection.toml

(cherry picked from commit 0469785)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@Aegrah Aegrah Aegrah approved these changes

@brokensound77 brokensound77 Awaiting requested review from brokensound77

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

@imays11 imays11 Awaiting requested review from imays11

@Samirbous Samirbous Awaiting requested review from Samirbous

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

Assignees

@w0rk3r w0rk3r

Labels
backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@w0rk3r @Aegrah @terrancedejesus