Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e052677

Browse files
nasbenchphantinuss
nasbench
and
phantinuss
authored
Merge PR SigmaHQ#4577 from @nasbench - Multiple Fixes & Updates
fix: Access To Windows Credential History File By Uncommon Application - Enhance FP filters fix: Access To Windows DPAPI Master Keys By Uncommon Application - Enhance FP filters fix: Amsi.DLL Load By Uncommon Process - Moved to threat hunting folder and update false positive filters to remove hardcoded C: fix: Bad Opsec Defaults Sacrificial Processes With Improper Arguments - Typo in condition fix: Credential Manager Access By Uncommon Application - Enhance FP filters fix: Elevated System Shell Spawned From Uncommon Parent Location - Enhance FP filters fix: Execution of Suspicious File Type Extension - Add new extensions to reduce FP fix: Important Windows Eventlog Cleared - Update selection to remove "Application" log as it was generating a lot of FP in some environments fix: Malicious PowerShell Commandlets - ScriptBlock - Remove some part of the selection due to FP matches as they were generic cmdlet names fix: Potential Direct Syscall of NtOpenProcess - Add "Adobe" filter fix: Potential Shim Database Persistence via Sdbinst.EXE - Update FP filter for "iisexpressshim" sdb fix: Potentially Suspicious AccessMask Requested From LSASS - Add new FP filter for "procmon" process fix: PowerView PowerShell Cmdlets - ScriptBlock - Remove some part of the selection due to FP matches as they were generic cmdlet names fix: PSScriptPolicyTest Creation By Uncommon Process - Add new filter for "sdiagnhost" fix: Relevant Anti-Virus Signature Keywords In Application Log - Update false positive filters fix: Remote Access Tool Services Have Been Installed - Security - Fix typo in field name fix: Suspicious File Creation Activity From Fake Recycle.Bin Folder - Remove RECYCLE.BIN\ as it was added as a typo and is a legitimate location. fix: Uncommon Child Process Of Conhost.EXE - Add new FP filters fix: Uncommon File Created In Office Startup Folder - Add new extension to filter out FP generated with MS Access databases fix: Uncommon PowerShell Hosts - Moved to threat hunting folder and updated false positive filter list fix: Use Of Remove-Item to Delete File - ScriptBlock - Moved to threat hunting folder and Update logic to be more accurate fix: User with Privileges Logon - Move to placeholder rules and update the FP filter to account for different workstations fix: Windows Event Auditing Disabled - Enhance list of false positive filters with additional GUID fix: WMI Module Loaded By Uncommon Process - Moved to threat hunting folder and update and restructure false positive filters new: Communication To Uncommon Destination Ports new: Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension remove: Credential Dumping Tools Service Execution remove: New Service Uses Double Ampersand in Path remove: Powershell File and Directory Discovery remove: PowerShell Scripts Run by a Services remove: Security Event Log Cleared remove: Suspicious Get-WmiObject remove: Windows Defender Threat Detection Disabled update: Access To Browser Credential Files By Uncommon Application - Increase level to medium and enhance filters and selections update: Add Potential Suspicious New Download Source To Winget - Reduce level to medium update: ADFS Database Named Pipe Connection By Uncommon Tool - Enhance coverage by improving paths selection update: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation - Reduce level to low update: Copy From Or To Admin Share Or Sysvol Folder - Enhance selection to be more accurate update: Eventlog Cleared - Update FP filter to remove "Application" log and increase coverage update: Failed Code Integrity Checks - Reduce level to informational update: HH.EXE Execution - Reduce level to low update: Locked Workstation - Reduce level to informational update: Malicious Driver Load By Name - Increase coverage based on LOLDrivers data update: Meterpreter or Cobalt Strike Getsystem Service Installation - Security - Reduce level to high and restructure selections update: Meterpreter or Cobalt Strike Getsystem Service Installation - System - Reduce level to high and restructure selections update: Potential Credential Dumping Activity Via LSASS - Reduce level to medium and comment out noisy access masks update: Potential PowerShell Execution Policy Tampering - Remove "RemoteSigned" as it doesn't fit with the current logic update: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location - Reduce level to medium and update logic update: Potentially Suspicious Malware Callback Communication - Increase coverage by adding new additional ports update: PUA - Nmap/Zenmap Execution - Reduce level to medium update: PUA - Process Hacker Execution - Reduce level to medium update: PUA - Radmin Viewer Utility Execution - Reduce level to medium update: Rundll32 Execution With Uncommon DLL Extension - Enhance DLL extension list update: SASS Access From Non System Account - Reduce level to medium and enhance false positive filters update: Suspicious Executable File Creation - Enhance coverage by removing hardocded "C:" update: Suspicious Program Location with Network Connections - Increase accuracy by enhancing the selection to focus on the start of the folder and partition update: Suspicious Schtasks From Env Var Folder - Reduce level to medium update: Suspicious Shim Database Patching Activity - Add new processes to increase coverage update: Uncommon Extension Shim Database Installation Via Sdbinst.EXE - Reduce level to medium update: Whoami Utility Execution - Reduce level to low update: Whoami.EXE Execution With Output Option - Reduce level to medium update: Windows Defender Malware Detection History Deletion - Reduce level to informational update: WMI Event Consumer Created Named Pipe - Reduce leve to medium --------- Co-authored-by: phantinuss <[email protected]> Thanks: @Blackmore-Robert Thanks: @swachchhanda000 Thanks: @celalettin-turgut Thanks: @AaronS97
1 parent 2cb6ccd commit e052677

126 files changed

Lines changed: 6481 additions & 4839 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

rules/windows/driver_load/driver_load_win_mal_creddumper.yml renamed to deprecated/windows/driver_load_win_mal_creddumper.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@ id: df5ff0a5-f83f-4a5b-bba1-3e6a3f6f6ea2
33
related:
44
- id: 4976aa50-8f41-45c6-8b15-ab3fc10e79ed
55
type: derived
6-
status: test
6+
status: deprecated
77
description: Detects well-known credential dumping tools execution via service execution events
88
references:
99
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
1010
author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
1111
date: 2017/03/05
12-
modified: 2022/12/25
12+
modified: 2023/12/11
1313
tags:
1414
- attack.credential_access
1515
- attack.execution

rules/windows/driver_load/driver_load_win_powershell_script_installed_as_service.yml renamed to deprecated/windows/driver_load_win_powershell_script_installed_as_service.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@ id: 46deb5e1-28c9-4905-b2df-51cdcc9e6073
33
related:
44
- id: a2e5019d-a658-4c6a-92bf-7197b54e2cae
55
type: derived
6-
status: test
6+
status: deprecated
77
description: Detects powershell script installed as a Service
88
references:
99
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
1010
author: oscd.community, Natalia Shornikova
1111
date: 2020/10/06
12-
modified: 2022/10/09
12+
modified: 2023/12/11
1313
tags:
1414
- attack.execution
1515
- attack.t1569.002

rules/windows/powershell/powershell_script/posh_ps_file_and_directory_discovery.yml renamed to deprecated/windows/posh_ps_file_and_directory_discovery.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
title: Powershell File and Directory Discovery
22
id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
3-
status: test
3+
status: deprecated
44
description: |
55
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
66
Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors,
@@ -9,7 +9,7 @@ references:
99
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
1010
author: frack113
1111
date: 2021/12/15
12-
modified: 2022/12/25
12+
modified: 2023/12/11
1313
tags:
1414
- attack.discovery
1515
- attack.t1083

rules/windows/powershell/powershell_script/posh_ps_susp_gwmi.yml renamed to deprecated/windows/posh_ps_susp_gwmi.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
title: Suspicious Get-WmiObject
22
id: 0332a266-b584-47b4-933d-a00b103e1b37
3-
status: test
3+
status: deprecated
44
description: The infrastructure for management data and operations that enables local and remote management of Windows personal computers and servers
55
references:
66
- https://attack.mitre.org/datasources/DS0005/
77
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7
88
author: frack113
99
date: 2022/01/12
10-
modified: 2022/11/02
10+
modified: 2023/12/11
1111
tags:
1212
- attack.persistence
1313
- attack.t1546

rules/windows/builtin/windefend/win_defender_disabled.yml renamed to deprecated/windows/win_defender_disabled.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
title: Windows Defender Threat Detection Disabled
22
id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
3-
status: stable
3+
status: deprecated
44
description: Detects disabling Windows Defender threat protection
55
references:
66
- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus
77
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
88
author: Ján Trenčanský, frack113
99
date: 2020/07/28
10-
modified: 2022/12/06
10+
modified: 2023/11/22
1111
tags:
1212
- attack.defense_evasion
1313
- attack.t1562.001

rules/windows/builtin/security/win_security_event_log_cleared.yml renamed to deprecated/windows/win_security_event_log_cleared.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
title: Security Event Log Cleared
22
id: a122ac13-daf8-4175-83a2-72c387be339d
3-
status: test
3+
status: deprecated
44
description: Checks for event id 1102 which indicates the security event log was cleared.
55
references:
66
- https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/SecurityEventLogCleared.yaml
77
author: Saw Winn Naung
88
date: 2021/08/15
9-
modified: 2022/12/25
9+
modified: 2023/12/06
1010
tags:
1111
- attack.t1070.001
1212
logsource:

rules/windows/builtin/system/service_control_manager/win_system_service_install_susp_double_ampersand.yml renamed to deprecated/windows/win_system_service_install_susp_double_ampersand.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
title: New Service Uses Double Ampersand in Path
22
id: ca83e9f3-657a-45d0-88d6-c1ac280caf53
3-
status: test
3+
status: deprecated
44
description: Detects a service installation that uses a suspicious double ampersand used in the image path value
55
references:
66
- Internal Research
77
author: Florian Roth (Nextron Systems)
88
date: 2022/07/05
9+
modified: 2023/11/15
910
tags:
1011
- attack.defense_evasion
1112
- attack.t1027

rules/windows/builtin/security/win_security_admin_logon.yml renamed to rules-placeholder/windows/builtin/security/win_security_admin_logon.yml

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ references:
88
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964
99
author: frack113
1010
date: 2022/10/14
11-
modified: 2022/10/22
11+
modified: 2023/12/14
1212
tags:
1313
- attack.defense_evasion
1414
- attack.lateral_movement
@@ -24,12 +24,11 @@ detection:
2424
EventID:
2525
- 4672
2626
- 4964
27-
filter:
28-
SubjectUserSid: S-1-5-18
29-
# Level can be upgrade to medium with a filter
30-
# filter_valid_account:
31-
# SubjectUserName: set valid internal naming pattern or a list a valid account
32-
condition: selection and not filter
27+
filter_main_local_system:
28+
SubjectUserSid: 'S-1-5-18'
29+
filter_main_valid_account:
30+
SubjectUserName|expand: '%Admins_Workstations%' # Set valid internal naming pattern or a list a valid account
31+
condition: selection and not 1 of filter_main_*
3332
falsepositives:
3433
- Unknown
3534
level: low

rules/windows/file/file_event/file_event_win_dump_file_creation.yml renamed to rules-threat-hunting/windows/file/file_event/file_event_win_dump_file_creation.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ author: Nasreddine Bencherchali (Nextron Systems)
88
date: 2023/09/07
99
tags:
1010
- attack.defense_evasion
11+
- detection.threat_hunting
1112
logsource:
1213
category: file_event
1314
product: windows

rules/windows/image_load/image_load_dll_amsi_uncommon_process.yml renamed to rules-threat-hunting/windows/image_load/image_load_dll_amsi_uncommon_process.yml

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,41 +8,42 @@ references:
88
- https://github.com/surya-dev-singh/AmsiBypass-OpenSession
99
author: frack113
1010
date: 2023/03/12
11-
modified: 2023/06/01
11+
modified: 2023/12/18
1212
tags:
1313
- attack.defense_evasion
1414
- attack.impact
1515
- attack.t1490
16+
- detection.threat_hunting
1617
logsource:
1718
category: image_load
1819
product: windows
1920
detection:
2021
selection:
2122
ImageLoaded|endswith: '\amsi.dll'
2223
filter_main_exact:
23-
Image:
24-
- 'C:\Windows\explorer.exe'
25-
- 'C:\Windows\Sysmon64.exe'
24+
Image|endswith:
25+
- ':\Windows\explorer.exe'
26+
- ':\Windows\Sysmon64.exe'
2627
filter_main_generic:
27-
Image|startswith:
28-
- 'C:\Program Files (x86)\'
29-
- 'C:\Program Files\'
30-
- 'C:\Windows\System32\'
31-
- 'C:\Windows\SysWOW64\'
32-
- 'C:\Windows\WinSxS\'
28+
Image|contains:
29+
- ':\Program Files (x86)\'
30+
- ':\Program Files\'
31+
- ':\Windows\System32\'
32+
- ':\Windows\SysWOW64\'
33+
- ':\Windows\WinSxS\'
3334
filter_optional_defender:
34-
Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
35+
Image|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
3536
Image|endswith: '\MsMpEng.exe'
3637
filter_main_dotnet:
37-
Image|startswith:
38-
- 'C:\Windows\Microsoft.NET\Framework\'
39-
- 'C:\Windows\Microsoft.NET\Framework64\'
38+
Image|contains:
39+
- ':\Windows\Microsoft.NET\Framework\'
40+
- ':\Windows\Microsoft.NET\Framework64\'
4041
Image|endswith: '\ngentask.exe'
4142
filter_main_null:
4243
Image: null
4344
filter_main_empty:
4445
Image: ''
45-
condition: selection and not 1 of filter_*
46+
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
4647
falsepositives:
4748
- Legitimate third party apps installed in "ProgramData" and "AppData" might generate some false positives. Apply additional filters accordingly
4849
level: low

0 commit comments

Comments
 (0)