Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ccec820

Browse files
nasbenchnasbench
authored
feat: new rules & updates (SigmaHQ#4328)
1 parent 3d2b11a commit ccec820

42 files changed

Lines changed: 867 additions & 312 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

rules/windows/process_creation/proc_creation_win_lolbin_office.yml renamed to deprecated/windows/proc_creation_win_lolbin_office.yml

File renamed without changes.

rules/windows/registry/registry_set/registry_set_disable_microsoft_office_security_features.yml renamed to deprecated/windows/registry_set_disable_microsoft_office_security_features.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
title: Disable Microsoft Office Security Features
22
id: 7c637634-c95d-4bbf-b26c-a82510874b34
3-
status: test
3+
status: deprecated
44
description: Disable Microsoft Office Security Features by registry
55
references:
66
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
77
- https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
88
- https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/
99
author: frack113
1010
date: 2021/06/08
11-
modified: 2022/03/26
11+
modified: 2023/06/21
1212
tags:
1313
- attack.defense_evasion
1414
- attack.t1562.001

rules/windows/registry/registry_set/registry_set_office_security.yml renamed to deprecated/windows/registry_set_office_security.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
title: Office Security Settings Changed
22
id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd
3-
status: experimental
3+
status: deprecated
44
description: Detects registry changes to Office macro settings. The TrustRecords contain information on executed macro-enabled documents. (see references)
55
references:
66
- https://twitter.com/inversecos/status/1494174785621819397
77
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/
88
- https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/
99
author: Trent Liffick (@tliffick)
1010
date: 2020/05/22
11-
modified: 2022/06/26
11+
modified: 2023/06/21
1212
tags:
1313
- attack.defense_evasion
1414
- attack.t1112

rules/windows/file/file_event/file_event_win_winword_cve_2021_40444.yml renamed to rules-emerging-threats/2021/Exploits/CVE-2021-40444/file_event_win_exploit_cve_2021_40444.yml

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ references:
77
- https://twitter.com/vanitasnk/status/1437329511142420483?s=21
88
author: Florian Roth (Nextron Systems), Sittikorn S
99
date: 2021/09/10
10-
modified: 2022/06/17
10+
modified: 2023/06/22
1111
tags:
1212
- attack.resource_development
1313
- attack.t1587
@@ -17,20 +17,18 @@ logsource:
1717
detection:
1818
selection_cab:
1919
Image|endswith: '\winword.exe'
20-
TargetFilename|endswith: '.cab'
2120
TargetFilename|contains: '\Windows\INetCache'
21+
TargetFilename|endswith: '.cab'
2222
selection_inf:
2323
Image|endswith: '\winword.exe'
2424
TargetFilename|contains|all:
2525
- '\AppData\Local\Temp\'
2626
- '.inf'
27-
filter_legit:
27+
filter_main_legit:
2828
TargetFilename|startswith: 'C:\Users\'
2929
TargetFilename|contains: 'AppData\Local\Temp'
3030
TargetFilename|endswith: '\Content.inf'
31-
condition: (selection_cab or selection_inf) and not filter_legit
32-
fields:
33-
- TargetFilename
31+
condition: 1 of selection_* and not 1 of filter_main_*
3432
falsepositives:
3533
- Unknown
3634
level: high

‎rules-threat-hunting/windows/registry/registry_set/registry_set_office_trusted_location.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
title: Microsoft Office Trusted Location Updated
2+
id: a0bed973-45fa-4625-adb5-6ecdf9be70ac
3+
related:
4+
- id: f742bde7-9528-42e5-bd82-84f51a8387d2
5+
type: similar
6+
status: experimental
7+
description: Detects changes to the registry keys related to "Trusted Location" of Microsoft Office. Attackers might add additional trusted locations to avoid macro security restrictions.
8+
references:
9+
- https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01
10+
author: Nasreddine Bencherchali (Nextron Systems)
11+
date: 2023/06/21
12+
tags:
13+
- attack.defense_evasion
14+
- attack.t1112
15+
- detection.threat_hunting
16+
logsource:
17+
category: registry_set
18+
product: windows
19+
detection:
20+
selection:
21+
EventType: Setvalue
22+
TargetObject|contains: 'Security\Trusted Locations\Location'
23+
TargetObject|endswith: '\Path'
24+
condition: selection
25+
falsepositives:
26+
- During office installations or setup, trusted locations are added, which will trigger this rule.
27+
level: medium

‎rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ references:
1111
- https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/event-id-explanations
1212
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
1313
date: 2022/01/20
14-
modified: 2023/06/06
14+
modified: 2023/06/20
1515
tags:
1616
- attack.execution
1717
logsource:
@@ -97,6 +97,10 @@ detection:
9797
ProcessNameBuffer|endswith: '\Windows\ImmersiveControlPanel\SystemSettings.exe'
9898
RequestedPolicy: 8
9999
ValidatedPolicy: 1
100+
filter_optional_trend_micro:
101+
FileNameBuffer|endswith: '\Trend Micro\Client Server Security Agent\perficrcperfmonmgr.dll'
102+
RequestedPolicy: 8
103+
ValidatedPolicy: 1
100104
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
101105
falsepositives:
102106
- Antivirus and other third party products. Apply additional filters accordingly

‎rules/windows/builtin/security/win_security_disable_event_auditing.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
title: Windows Event Auditing Disabled
2+
id: 69aeb277-f15f-4d2d-b32a-55e883609563
3+
related:
4+
- id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1
5+
type: derived
6+
status: test
7+
description: |
8+
Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled.
9+
This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed.
10+
Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc".
11+
Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways.
12+
references:
13+
- https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit
14+
author: '@neu5ron, Nasreddine Bencherchali (Nextron Systems)'
15+
date: 2017/11/19
16+
modified: 2021/11/27
17+
tags:
18+
- attack.defense_evasion
19+
- attack.t1562.002
20+
logsource:
21+
product: windows
22+
service: security
23+
definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64
24+
detection:
25+
selection:
26+
EventID: 4719
27+
AuditPolicyChanges|contains:
28+
- '%%8448' # This is "Success removed"
29+
- '%%8450' # This is "Failure removed"
30+
filter_main_guid:
31+
# Note: We filter these GUID to avoid alert duplication as these are covered by ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1
32+
SubcategoryGuid:
33+
# Note: Add or remove GUID as you see fit in your env
34+
- '{0CCE9215-69AE-11D9-BED3-505054503030}' # Audit Logon
35+
- '{0CCE922B-69AE-11D9-BED3-505054503030}' # Audit Process Creation
36+
- '{0CCE9240-69AE-11D9-BED3-505054503030}' # Audit Kerberos Service Ticket Operations
37+
- '{0CCE9210-69AE-11D9-BED3-505054503030}' # Audit Security State Change
38+
- '{0CCE9211-69AE-11D9-BED3-505054503030}' # Audit Security System Extension
39+
- '{0CCE9212-69AE-11D9-BED3-505054503030}' # Audit System Integrity
40+
- '{0CCE921B-69AE-11D9-BED3-505054503030}' # Audit Special Logon
41+
- '{0CCE922F-69AE-11D9-BED3-505054503030}' # Audit Audit Policy Change
42+
- '{0CCE9230-69AE-11D9-BED3-505054503030}' # Audit Authentication Policy Change
43+
- '{0CCE9235-69AE-11D9-BED3-505054503030}' # Audit User Account Management
44+
- '{0CCE9236-69AE-11D9-BED3-505054503030}' # Audit Computer Account Management
45+
- '{0CCE9237-69AE-11D9-BED3-505054503030}' # Audit Security Group Management
46+
- '{0CCE923F-69AE-11D9-BED3-505054503030}' # Audit Credential Validation
47+
- '{0CCE9242-69AE-11D9-BED3-505054503030}' # Audit Kerberos Authentication Service'
48+
- '{0CCE9217-69AE-11D9-BED3-505054503030}' # Audit Account Lockout
49+
condition: selection and not filter_main_guid
50+
falsepositives:
51+
- Unknown
52+
level: medium

‎rules/windows/builtin/security/win_security_disable_event_auditing_critical.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
title: Important Windows Event Auditing Disabled
2+
id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1
3+
related:
4+
- id: 69aeb277-f15f-4d2d-b32a-55e883609563
5+
type: derived
6+
status: test
7+
description: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.
8+
references:
9+
- https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit
10+
- https://github.com/SigmaHQ/sigma/blob/master/documentation/logsource-guides/windows/service/security.md
11+
author: Nasreddine Bencherchali (Nextron Systems)
12+
date: 2023/06/20
13+
tags:
14+
- attack.defense_evasion
15+
- attack.t1562.002
16+
logsource:
17+
product: windows
18+
service: security
19+
definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64
20+
detection:
21+
selection_state_success_and_failure:
22+
EventID: 4719
23+
SubcategoryGuid:
24+
# Note: Add or remove GUID as you see fit in your env
25+
- '{0CCE9215-69AE-11D9-BED3-505054503030}' # Audit Logon
26+
- '{0CCE922B-69AE-11D9-BED3-505054503030}' # Audit Process Creation
27+
- '{0CCE9240-69AE-11D9-BED3-505054503030}' # Audit Kerberos Service Ticket Operations
28+
- '{0CCE9210-69AE-11D9-BED3-505054503030}' # Audit Security State Change
29+
- '{0CCE9211-69AE-11D9-BED3-505054503030}' # Audit Security System Extension
30+
- '{0CCE9212-69AE-11D9-BED3-505054503030}' # Audit System Integrity
31+
- '{0CCE921B-69AE-11D9-BED3-505054503030}' # Audit Special Logon
32+
- '{0CCE922F-69AE-11D9-BED3-505054503030}' # Audit Audit Policy Change
33+
- '{0CCE9230-69AE-11D9-BED3-505054503030}' # Audit Authentication Policy Change
34+
- '{0CCE9235-69AE-11D9-BED3-505054503030}' # Audit User Account Management
35+
- '{0CCE9236-69AE-11D9-BED3-505054503030}' # Audit Computer Account Management
36+
- '{0CCE9237-69AE-11D9-BED3-505054503030}' # Audit Security Group Management
37+
- '{0CCE923F-69AE-11D9-BED3-505054503030}' # Audit Credential Validation
38+
- '{0CCE9242-69AE-11D9-BED3-505054503030}' # Audit Kerberos Authentication Service
39+
AuditPolicyChanges|contains:
40+
- '%%8448' # This is "Success removed"
41+
- '%%8450' # This is "Failure removed"
42+
selection_state_success_only:
43+
EventID: 4719
44+
SubcategoryGuid: '{0CCE9217-69AE-11D9-BED3-505054503030}' # Audit Account Lockout
45+
AuditPolicyChanges|contains: '%%8448'
46+
condition: 1 of selection_*
47+
falsepositives:
48+
- Unlikely
49+
level: high

‎rules/windows/builtin/security/win_security_disable_event_logging.yml‎

Lines changed: 0 additions & 30 deletions
This file was deleted.

‎rules/windows/file/file_event/file_event_win_office_startup_persistence.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
title: Potential Persistence Via Microsoft Office Startup Folder
2+
id: 0e20c89d-2264-44ae-8238-aeeaba609ece
3+
status: test
4+
description: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
5+
references:
6+
- https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
7+
- https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders
8+
author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
9+
date: 2022/06/02
10+
modified: 2023/06/22
11+
tags:
12+
- attack.persistence
13+
- attack.t1137
14+
logsource:
15+
category: file_event
16+
product: windows
17+
detection:
18+
selection_word_paths:
19+
- TargetFilename|contains: '\Microsoft\Word\STARTUP'
20+
- TargetFilename|contains|all:
21+
- '\Office'
22+
- '\Program Files'
23+
- '\STARTUP'
24+
selection_word_extension:
25+
TargetFilename|endswith:
26+
- '.doc'
27+
- '.docm'
28+
- '.docx'
29+
- '.dot'
30+
- '.dotm'
31+
- '.rtf'
32+
selection_excel_paths:
33+
- TargetFilename|contains: '\Microsoft\Excel\XLSTART'
34+
- TargetFilename|contains|all:
35+
- '\Office'
36+
- '\Program Files'
37+
- '\XLSTART'
38+
selection_excel_extension:
39+
TargetFilename|endswith:
40+
- '.xls'
41+
- '.xlsm'
42+
- '.xlsx'
43+
- '.xlt'
44+
- '.xltm'
45+
filter_main_office:
46+
Image|endswith:
47+
- '\WINWORD.exe'
48+
- '\EXCEL.exe'
49+
condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office
50+
falsepositives:
51+
- Loading a user environment from a backup or a domain controller
52+
- Synchronization of templates
53+
level: high

0 commit comments

Comments
 (0)