# custom_values

customized_type: Issue
value:
  title: Microsoft Binary Suspicious Communication Endpoint
  id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
  status: experimental
  description: Detects an executable in the Windows folder accessing suspicious domains
  references:
      - https://twitter.com/M_haggis/status/900741347035889665
      - https://twitter.com/M_haggis/status/1032799638213066752
  author: Florian Roth
  date: 2018/08/30
  tags:
      - attack.lateral_movement
      - attack.t1105
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          Initiated: 'true'
          DestinationHostname: 
              - '*dl.dropboxusercontent.com'
              - '*.pastebin.com'
              - '*.githubusercontent.com' # includes both gists and github repositories
          Image: 'C:\Windows\\*'
      condition: selection
  falsepositives:
      - 'Unknown'
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:3 AND
          Initiated:true AND event_data.DestinationHostname:(*dl.dropboxusercontent.com
          OR *.pastebin.com OR *.githubusercontent.com) AND event_data.Image:C\:\\Windows\\\\*)
  index: logstash-beats-*
  name: Microsoft Binary Suspicious Communication Endpoint
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/M_haggis/status/900741347035889665
  https://twitter.com/M_haggis/status/1032799638213066752


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Microsoft Binary Suspicious Communication Endpoint
  id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
  status: experimental
  description: Detects an executable in the Windows folder accessing suspicious domains
  references:
      - https://twitter.com/M_haggis/status/900741347035889665
      - https://twitter.com/M_haggis/status/1032799638213066752
  author: Florian Roth
  date: 2018/08/30
  tags:
      - attack.lateral_movement
      - attack.t1105
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          Initiated: 'true'
          DestinationHostname: 
              - '*dl.dropboxusercontent.com'
              - '*.pastebin.com'
              - '*.githubusercontent.com' # includes both gists and github repositories
          Image: 'C:\Windows\\*'
      condition: selection
  falsepositives:
      - 'Unknown'
  level: high


  </code></pre>
  }}


customized_type: Issue
value:
  title: Rundll32 Internet Connection
  id: cdc8da7d-c303-42f8-b08c-b4ab47230263
  status: experimental
  description: Detects a rundll32 that communicates with public IP addresses
  references:
      - https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6?environmentId=100
  author: Florian Roth
  date: 2017/11/04
  tags:
      - attack.t1085
      - attack.defense_evasion
      - attack.execution
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          Image: '*\rundll32.exe'
          Initiated: 'true'
      filter:
          DestinationIp: 
              - '10.*'
              - '192.168.*'
              - '172.16.*'
              - '172.17.*'
              - '172.18.*'
              - '172.19.*'
              - '172.20.*'
              - '172.21.*'
              - '172.22.*'
              - '172.23.*'
              - '172.24.*'
              - '172.25.*'
              - '172.26.*'
              - '172.27.*'
              - '172.28.*'
              - '172.29.*'
              - '172.30.*'
              - '172.31.*'
              - '127.*'
      condition: selection and not filter
  falsepositives:
      - Communication to other corporate systems that use IP addresses from public address spaces
  level: medium


customized_type: Issue
value:
  _False Positives_
  Communication to other corporate systems that use IP addresses from public address spaces


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:3 AND
          event_data.Image:*\\rundll32.exe AND Initiated:true) AND (NOT (event_data.DestinationIp:(10.*
          OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR
          172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.*
          OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.*))))
  index: logstash-beats-*
  name: Rundll32 Internet Connection
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Rundll32 Internet Connection
  id: cdc8da7d-c303-42f8-b08c-b4ab47230263
  status: experimental
  description: Detects a rundll32 that communicates with public IP addresses
  references:
      - https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6?environmentId=100
  author: Florian Roth
  date: 2017/11/04
  tags:
      - attack.t1085
      - attack.defense_evasion
      - attack.execution
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          Image: '*\rundll32.exe'
          Initiated: 'true'
      filter:
          DestinationIp: 
              - '10.*'
              - '192.168.*'
              - '172.16.*'
              - '172.17.*'
              - '172.18.*'
              - '172.19.*'
              - '172.20.*'
              - '172.21.*'
              - '172.22.*'
              - '172.23.*'
              - '172.24.*'
              - '172.25.*'
              - '172.26.*'
              - '172.27.*'
              - '172.28.*'
              - '172.29.*'
              - '172.30.*'
              - '172.31.*'
              - '127.*'
      condition: selection and not filter
  falsepositives:
      - Communication to other corporate systems that use IP addresses from public address spaces
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  title: RDP over Reverse SSH Tunnel
  id: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
  status: experimental
  description: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
  references:
      - https://twitter.com/SBousseaden/status/1096148422984384514
  author: Samir Bousseaden
  date: 2019/02/16
  tags:
      - attack.defense_evasion
      - attack.command_and_control
      - attack.t1076
      - car.2013-07-002
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          Image: '*\svchost.exe'
          Initiated: 'true'
          SourcePort: 3389 
          DestinationIp:
              - '127.*'
              - '::1'
      condition: selection
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:3 AND
          event_data.Image:*\\svchost.exe AND Initiated:true AND SourcePort:3389 AND
          event_data.DestinationIp:(127.* OR \:\:1))
  index: logstash-beats-*
  name: RDP over Reverse SSH Tunnel
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: RDP over Reverse SSH Tunnel
  id: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
  status: experimental
  description: Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
  references:
      - https://twitter.com/SBousseaden/status/1096148422984384514
  author: Samir Bousseaden
  date: 2019/02/16
  tags:
      - attack.defense_evasion
      - attack.command_and_control
      - attack.t1076
      - car.2013-07-002
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          Image: '*\svchost.exe'
          Initiated: 'true'
          SourcePort: 3389 
          DestinationIp:
              - '127.*'
              - '::1'
      condition: selection
  falsepositives:
      - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: UAC Bypass via sdclt
  id: 5b872a46-3b90-45c1-8419-f675db8053aa
  status: experimental
  description: Detects changes to HKCU:\Software\Classes\exefile\shell\runas\command\isolatedCommand
  references:
      - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
  author: Omer Yampel
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 13 
          TargetObject: 'HKEY_USERS\\*\Classes\exefile\shell\runas\command\isolatedCommand'
      condition: selection
  tags:
      - attack.defense_evasion
      - attack.privilege_escalation
      - attack.t1088
      - car.2019-04-001
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:HKEY_USERS\\\\*\\Classes\\exefile\\shell\\runas\\command\\isolatedCommand)
  index: logstash-beats-*
  name: UAC Bypass via sdclt
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: UAC Bypass via sdclt
  id: 5b872a46-3b90-45c1-8419-f675db8053aa
  status: experimental
  description: Detects changes to HKCU:\Software\Classes\exefile\shell\runas\command\isolatedCommand
  references:
      - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
  author: Omer Yampel
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 13 
          TargetObject: 'HKEY_USERS\\*\Classes\exefile\shell\runas\command\isolatedCommand'
      condition: selection
  tags:
      - attack.defense_evasion
      - attack.privilege_escalation
      - attack.t1088
      - car.2019-04-001
  falsepositives:
      - unknown
  level: high


  </code></pre>
  }}


customized_type: Issue
value:
  title: QuarksPwDump Dump File
  id: 847def9e-924d-4e90-b7c4-5f581395a2b4
  status: experimental
  description: Detects a dump file written by QuarksPwDump password dumper
  references:
      - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm
  author: Florian Roth
  date: 2018/02/10
  tags:
    - attack.credential_access
    - attack.t1003
  level: critical
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          # Sysmon: File Creation (ID 11)
          EventID: 11
          TargetFilename: '*\AppData\Local\Temp\SAM-*.dmp*'
      condition: selection
  falsepositives:
      - Unknown


customized_type: Issue
value:
  title: PowerShell Network Connections
  id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
  status: experimental
  description: Detects a Powershell process that opens network connections - check for suspicious target ports and target systems - adjust to your environment (e.g.
      extend filters with company's ip range')
  author: Florian Roth
  references:
      - https://www.youtube.com/watch?v=DLtJTxMWZ2o
  tags:
      - attack.execution
      - attack.t1086
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          Image: '*\powershell.exe'
          Initiated: 'true'
      filter:
          DestinationIp: 
              - '10.*'
              - '192.168.*'
              - '172.16.*'
              - '172.17.*'
              - '172.18.*'
              - '172.19.*'
              - '172.20.*'
              - '172.21.*'
              - '172.22.*'
              - '172.23.*'
              - '172.24.*'
              - '172.25.*'
              - '172.26.*'
              - '172.27.*'
              - '172.28.*'
              - '172.29.*'
              - '172.30.*'
              - '172.31.*'
              - '127.0.0.1'
          DestinationIsIpv6: 'false'
          User: 'NT AUTHORITY\SYSTEM'
      condition: selection and not filter
  falsepositives:
      - Administrative scripts
  level: low


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          event_data.TargetFilename:*\\AppData\\Local\\Temp\\SAM\-*.dmp*)
  index: logstash-beats-*
  name: QuarksPwDump Dump File
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: QuarksPwDump Dump File
  id: 847def9e-924d-4e90-b7c4-5f581395a2b4
  status: experimental
  description: Detects a dump file written by QuarksPwDump password dumper
  references:
      - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm
  author: Florian Roth
  date: 2018/02/10
  tags:
    - attack.credential_access
    - attack.t1003
  level: critical
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          # Sysmon: File Creation (ID 11)
          EventID: 11
          TargetFilename: '*\AppData\Local\Temp\SAM-*.dmp*'
      condition: selection
  falsepositives:
      - Unknown


  </code></pre>
  }}


customized_type: Issue
value:
  Detects a Powershell process that opens network connections - check for suspicious target ports and target systems - adjust to your environment (e.g. extend filters with company's ip range')


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:3 AND
          event_data.Image:*\\powershell.exe AND Initiated:true) AND (NOT (event_data.DestinationIp:(10.*
          OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR
          172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.*
          OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.0.0.1) AND event_data.DestinationIsIpv6:false
          AND event_data.User:NT\ AUTHORITY\\SYSTEM)))
  index: logstash-beats-*
  name: PowerShell Network Connections
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: PowerShell Network Connections
  id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
  status: experimental
  description: Detects a Powershell process that opens network connections - check for suspicious target ports and target systems - adjust to your environment (e.g.
      extend filters with company's ip range')
  author: Florian Roth
  references:
      - https://www.youtube.com/watch?v=DLtJTxMWZ2o
  tags:
      - attack.execution
      - attack.t1086
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          Image: '*\powershell.exe'
          Initiated: 'true'
      filter:
          DestinationIp: 
              - '10.*'
              - '192.168.*'
              - '172.16.*'
              - '172.17.*'
              - '172.18.*'
              - '172.19.*'
              - '172.20.*'
              - '172.21.*'
              - '172.22.*'
              - '172.23.*'
              - '172.24.*'
              - '172.25.*'
              - '172.26.*'
              - '172.27.*'
              - '172.28.*'
              - '172.29.*'
              - '172.30.*'
              - '172.31.*'
              - '127.0.0.1'
          DestinationIsIpv6: 'false'
          User: 'NT AUTHORITY\SYSTEM'
      condition: selection and not filter
  falsepositives:
      - Administrative scripts
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  title: Mimikatz Detection LSASS Access
  id: 0d894093-71bc-43c3-8c4d-ecfc28dcf5d9
  status: experimental
  description: Detects process access to LSASS which is typical for Mimikatz (0x1000 PROCESS_QUERY_ LIMITED_INFORMATION, 0x0400 PROCESS_QUERY_ INFORMATION "only old
      versions", 0x0010 PROCESS_VM_READ)
  references:
      - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
      - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  tags:
      - attack.t1003
      - attack.s0002
      - attack.credential_access
      - car.2019-04-004
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 10
          TargetImage: 'C:\windows\system32\lsass.exe'
          GrantedAccess:
              - '0x1410'      
              - '0x1010'      
      condition: selection
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  Detects process access to LSASS which is typical for Mimikatz (0x1000 PROCESS_QUERY_ LIMITED_INFORMATION, 0x0400 PROCESS_QUERY_ INFORMATION "only old versions", 0x0010 PROCESS_VM_READ)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:10 AND
          event_data.TargetImage:C\:\\windows\\system32\\lsass.exe AND event_data.GrantedAccess:(0x1410
          OR 0x1010))
  index: logstash-beats-*
  name: Mimikatz Detection LSASS Access
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Mimikatz Detection LSASS Access
  id: 0d894093-71bc-43c3-8c4d-ecfc28dcf5d9
  status: experimental
  description: Detects process access to LSASS which is typical for Mimikatz (0x1000 PROCESS_QUERY_ LIMITED_INFORMATION, 0x0400 PROCESS_QUERY_ INFORMATION "only old
      versions", 0x0010 PROCESS_VM_READ)
  references:
      - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
      - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  tags:
      - attack.t1003
      - attack.s0002
      - attack.credential_access
      - car.2019-04-004
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 10
          TargetImage: 'C:\windows\system32\lsass.exe'
          GrantedAccess:
              - '0x1410'      
              - '0x1010'      
      condition: selection
  falsepositives:
      - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: RDP Sensitive Settings Changed
  id: 171b67e1-74b4-460e-8d55-b331f3e32d67
  description: Detects changes to RDP terminal service sensitive settings
  references:
      - https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
  date: 2019/04/03
  author: Samir Bousseaden
  logsource:
      product: windows
      service: sysmon
  detection:
      selection_reg:
          EventID: 13
          TargetObject:
              - '*\services\TermService\Parameters\ServiceDll*'
              - '*\Control\Terminal Server\fSingleSessionPerUser*'
              - '*\Control\Terminal Server\fDenyTSConnections*'
      condition: selection_reg
  tags:
      - attack.defense_evasion
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\services\\TermService\\Parameters\\ServiceDll*
          OR *\\Control\\Terminal\ Server\\fSingleSessionPerUser* OR *\\Control\\Terminal\
          Server\\fDenyTSConnections*))
  index: logstash-beats-*
  name: RDP Sensitive Settings Changed
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: RDP Sensitive Settings Changed
  id: 171b67e1-74b4-460e-8d55-b331f3e32d67
  description: Detects changes to RDP terminal service sensitive settings
  references:
      - https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
  date: 2019/04/03
  author: Samir Bousseaden
  logsource:
      product: windows
      service: sysmon
  detection:
      selection_reg:
          EventID: 13
          TargetObject:
              - '*\services\TermService\Parameters\ServiceDll*'
              - '*\Control\Terminal Server\fSingleSessionPerUser*'
              - '*\Control\Terminal Server\fDenyTSConnections*'
      condition: selection_reg
  tags:
      - attack.defense_evasion
  falsepositives:
      - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: LSASS Memory Dump
  id: 5ef9853e-4d0e-4a70-846f-a9ca37d876da
  status: experimental
  description: Detects process LSASS memory dump using procdump or taskmgr based on the CallTrace pointing to dbghelp.dll or dbgcore.dll for win10
  author: Samir Bousseaden
  references:
      - https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html
  tags:
      - attack.t1003
      - attack.s0002
      - attack.credential_access
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 10
          TargetImage: 'C:\windows\system32\lsass.exe'
          GrantedAccess: '0x1fffff'
          CallTrace:
           - '*dbghelp.dll*'
           - '*dbgcore.dll*'
      condition: selection
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  Detects process LSASS memory dump using procdump or taskmgr based on the CallTrace pointing to dbghelp.dll or dbgcore.dll for win10


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:10 AND
          event_data.TargetImage:C\:\\windows\\system32\\lsass.exe AND event_data.GrantedAccess:0x1fffff
          AND event_data.CallTrace:(*dbghelp.dll* OR *dbgcore.dll*))
  index: logstash-beats-*
  name: LSASS Memory Dump
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: LSASS Memory Dump
  id: 5ef9853e-4d0e-4a70-846f-a9ca37d876da
  status: experimental
  description: Detects process LSASS memory dump using procdump or taskmgr based on the CallTrace pointing to dbghelp.dll or dbgcore.dll for win10
  author: Samir Bousseaden
  references:
      - https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html
  tags:
      - attack.t1003
      - attack.s0002
      - attack.credential_access
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 10
          TargetImage: 'C:\windows\system32\lsass.exe'
          GrantedAccess: '0x1fffff'
          CallTrace:
           - '*dbghelp.dll*'
           - '*dbgcore.dll*'
      condition: selection
  falsepositives:
      - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: New RUN Key Pointing to Suspicious Folder
  id: 02ee49e2-e294-4d0f-9278-f5b3212fc588
  status: experimental
  description: Detects suspicious new RUN key element pointing to an executable in a suspicious folder
  references:
      - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
  author: Florian Roth, Markus Neis
  tags:
      - attack.persistence
      - attack.t1060
  date: 2018/25/08
  modified: 2019/10/01
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 13
          TargetObject: 
            - '*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\*'
            - '*\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\\*'
          Details:
            - '*C:\Windows\Temp\\*'
            - '*\AppData\\*'
            - '%AppData%\\*'
            - '*C:\$Recycle.bin\\*'
            - '*C:\Temp\\*'
            - '*C:\Users\Public\\*'
            - '%Public%\\*'
            - '*C:\Users\Default\\*'
            - '*C:\Users\Desktop\\*'
            - 'wscript*'
            - 'cscript*'
      condition: selection
  fields:
      - Image
  falsepositives:
      - Software with rare behaviour
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\\\*
          OR *\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\\\*) AND event_data.Details:(*C\:\\Windows\\Temp\\\\*
          OR *\\AppData\\\\* OR %AppData%\\\\* OR *C\:\\$Recycle.bin\\\\* OR *C\:\\Temp\\\\*
          OR *C\:\\Users\\Public\\\\* OR %Public%\\\\* OR *C\:\\Users\\Default\\\\*
          OR *C\:\\Users\\Desktop\\\\* OR wscript* OR cscript*))
  index: logstash-beats-*
  name: New RUN Key Pointing to Suspicious Folder
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: New RUN Key Pointing to Suspicious Folder
  id: 02ee49e2-e294-4d0f-9278-f5b3212fc588
  status: experimental
  description: Detects suspicious new RUN key element pointing to an executable in a suspicious folder
  references:
      - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
  author: Florian Roth, Markus Neis
  tags:
      - attack.persistence
      - attack.t1060
  date: 2018/25/08
  modified: 2019/10/01
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 13
          TargetObject: 
            - '*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\*'
            - '*\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\\*'
          Details:
            - '*C:\Windows\Temp\\*'
            - '*\AppData\\*'
            - '%AppData%\\*'
            - '*C:\$Recycle.bin\\*'
            - '*C:\Temp\\*'
            - '*C:\Users\Public\\*'
            - '%Public%\\*'
            - '*C:\Users\Default\\*'
            - '*C:\Users\Desktop\\*'
            - 'wscript*'
            - 'cscript*'
      condition: selection
  fields:
      - Image
  falsepositives:
      - Software with rare behaviour
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: CobaltStrike Process Injection
  id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42
  description: Detects a possible remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
  references:
      - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
      - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/
  tags:
      - attack.defense_evasion
      - attack.t1055
  status: experimental
  author: Olaf Hartong, Florian Roth, Aleksey Potapov, oscd.community
  date: 2018/11/30
  modified: 2019/11/08
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 8
          TargetProcessAddress|endswith: 
              - '0B80'
              - '0C7C'
              - '0C88'
      condition: selection
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  Detects a possible remote threat creation with certain characteristics which are typical for Cobalt Strike beacons


customized_type: Issue
value:
  https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
  https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: CobaltStrike Process Injection
  id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42
  description: Detects a possible remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
  references:
      - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
      - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/
  tags:
      - attack.defense_evasion
      - attack.t1055
  status: experimental
  author: Olaf Hartong, Florian Roth, Aleksey Potapov, oscd.community
  date: 2018/11/30
  modified: 2019/11/08
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 8
          TargetProcessAddress|endswith: 
              - '0B80'
              - '0C7C'
              - '0C88'
      condition: selection
  falsepositives:
      - unknown
  level: high


  </code></pre>
  }}


customized_type: Issue
value:
  title: PowerShell Rundll32 Remote Thread Creation
  id: 99b97608-3e21-4bfe-8217-2a127c396a0e
  status: experimental
  description: Detects PowerShell remote thread creation in Rundll32.exe
  author: Florian Roth
  references:
      - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html
  date: 2018/06/25
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 8
          SourceImage: '*\powershell.exe'
          TargetImage: '*\rundll32.exe'
      condition: selection
  tags:
      - attack.defense_evasion
      - attack.execution
      - attack.t1085
      - attack.t1086
  falsepositives:
      - Unkown
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:8 AND
          event_data.SourceImage:*\\powershell.exe AND event_data.TargetImage:*\\rundll32.exe)
  index: logstash-beats-*
  name: PowerShell Rundll32 Remote Thread Creation
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: PowerShell Rundll32 Remote Thread Creation
  id: 99b97608-3e21-4bfe-8217-2a127c396a0e
  status: experimental
  description: Detects PowerShell remote thread creation in Rundll32.exe
  author: Florian Roth
  references:
      - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html
  date: 2018/06/25
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 8
          SourceImage: '*\powershell.exe'
          TargetImage: '*\rundll32.exe'
      condition: selection
  tags:
      - attack.defense_evasion
      - attack.execution
      - attack.t1085
      - attack.t1086
  falsepositives:
      - Unkown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: DLL Load via LSASS
  id: b3503044-60ce-4bf4-bbcb-e3db98788823
  status: experimental
  description: Detects a method to load DLL via LSASS process using an undocumented Registry key
  author: Florian Roth
  date: 2019/10/16
  references:
      - https://blog.xpnsec.com/exploring-mimikatz-part-1/
      - https://twitter.com/SBousseaden/status/1183745981189427200
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID:
              - 12 
              - 13
          TargetObject: 
              - '*\CurrentControlSet\Services\NTDS\DirectoryServiceExtPt*'
              - '*\CurrentControlSet\Services\NTDS\LsaDbExtPt*'
      condition: selection
  tags:
      - attack.execution
      - attack.t1177
  falsepositives:
      - Unknown
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:(12 OR
          13) AND event_data.TargetObject:(*\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt*
          OR *\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt*))
  index: logstash-beats-*
  name: DLL Load via LSASS
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://blog.xpnsec.com/exploring-mimikatz-part-1/
  https://twitter.com/SBousseaden/status/1183745981189427200


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: DLL Load via LSASS
  id: b3503044-60ce-4bf4-bbcb-e3db98788823
  status: experimental
  description: Detects a method to load DLL via LSASS process using an undocumented Registry key
  author: Florian Roth
  date: 2019/10/16
  references:
      - https://blog.xpnsec.com/exploring-mimikatz-part-1/
      - https://twitter.com/SBousseaden/status/1183745981189427200
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID:
              - 12 
              - 13
          TargetObject: 
              - '*\CurrentControlSet\Services\NTDS\DirectoryServiceExtPt*'
              - '*\CurrentControlSet\Services\NTDS\LsaDbExtPt*'
      condition: selection
  tags:
      - attack.execution
      - attack.t1177
  falsepositives:
      - Unknown
  level: high


  </code></pre>
  }}


customized_type: Issue
value:
  title: DHCP Callout DLL installation
  id: 9d3436ef-9476-4c43-acca-90ce06bdf33a
  status: experimental
  description: Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the
      DHCP server (restart required)
  references:
      - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
      - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
      - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
  date: 2017/05/15
  author: Dimitrios Slamaris
  tags:
      - attack.defense_evasion
      - attack.t1073
      - attack.t1112
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 13
          TargetObject: 
              - '*\Services\DHCPServer\Parameters\CalloutDlls'
              - '*\Services\DHCPServer\Parameters\CalloutEnabled'
      condition: selection
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\Services\\DHCPServer\\Parameters\\CalloutDlls
          OR *\\Services\\DHCPServer\\Parameters\\CalloutEnabled))
  index: logstash-beats-*
  name: DHCP Callout DLL installation
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
  https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
  https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: DHCP Callout DLL installation
  id: 9d3436ef-9476-4c43-acca-90ce06bdf33a
  status: experimental
  description: Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the
      DHCP server (restart required)
  references:
      - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
      - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
      - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
  date: 2017/05/15
  author: Dimitrios Slamaris
  tags:
      - attack.defense_evasion
      - attack.t1073
      - attack.t1112
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 13
          TargetObject: 
              - '*\Services\DHCPServer\Parameters\CalloutDlls'
              - '*\Services\DHCPServer\Parameters\CalloutEnabled'
      condition: selection
  falsepositives:
      - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Renamed PowerShell
  id: d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20
  status: experimental
  description: Detects the execution of a renamed PowerShell often used by attackers or malware
  references:
      - https://twitter.com/christophetd/status/1164506034720952320
  author: Florian Roth
  date: 2019/08/22
  tags:
      - car.2013-05-009
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          Description: 'Windows PowerShell'
          Company: 'Microsoft Corporation'
      filter:
          Image: 
              - '*\powershell.exe'
              - '*\powershell_ise.exe'
      condition: selection and not filter
  falsepositives:
      - Unknown
  level: critical


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_data.Description:Windows\
          PowerShell AND event_data.Company:Microsoft\ Corporation) AND (NOT (event_data.Image:(*\\powershell.exe
          OR *\\powershell_ise.exe))))
  index: logstash-beats-*
  name: Renamed PowerShell
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Renamed PowerShell
  id: d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20
  status: experimental
  description: Detects the execution of a renamed PowerShell often used by attackers or malware
  references:
      - https://twitter.com/christophetd/status/1164506034720952320
  author: Florian Roth
  date: 2019/08/22
  tags:
      - car.2013-05-009
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          Description: 'Windows PowerShell'
          Company: 'Microsoft Corporation'
      filter:
          Image: 
              - '*\powershell.exe'
              - '*\powershell_ise.exe'
      condition: selection and not filter
  falsepositives:
      - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  title: Detection of SafetyKatz
  id: e074832a-eada-4fd7-94a1-10642b130e16
  status: experimental
  description: Detects possible SafetyKatz Behaviour
  references:
      - https://github.com/GhostPack/SafetyKatz
  tags:
      - attack.credential_access
      - attack.t1003
  author: Markus Neis
  date: 2018/07/24
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 11
          TargetFilename: '*\Temp\debug.bin'
      condition: selection
  falsepositives:
      - Unknown
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          event_data.TargetFilename:*\\Temp\\debug.bin)
  index: logstash-beats-*
  name: Detection of SafetyKatz
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Detection of SafetyKatz
  id: e074832a-eada-4fd7-94a1-10642b130e16
  status: experimental
  description: Detects possible SafetyKatz Behaviour
  references:
      - https://github.com/GhostPack/SafetyKatz
  tags:
      - attack.credential_access
      - attack.t1003
  author: Markus Neis
  date: 2018/07/24
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 11
          TargetFilename: '*\Temp\debug.bin'
      condition: selection
  falsepositives:
      - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Mimikatz through Windows Remote Management
  id: aa35a627-33fb-4d04-a165-d33b4afca3e8
  description: Detects usage of mimikatz through WinRM protocol by monitoring access to lsass process by wsmprovhost.exe.
  references:
      - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
  status: stable
  author: Patryk Prauze - ING Tech
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 10
          TargetImage: 'C:\windows\system32\lsass.exe'
          SourceImage: 'C:\Windows\system32\wsmprovhost.exe'
      condition: selection
  tags:
      - attack.credential_access
      - attack.execution
      - attack.t1003
      - attack.t1028
      - attack.s0005
  falsepositives:
      - low
  level: high


customized_type: Issue
value:
  Detects usage of mimikatz through WinRM protocol by monitoring access to lsass process by wsmprovhost.exe.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:10 AND
          event_data.TargetImage:C\:\\windows\\system32\\lsass.exe AND event_data.SourceImage:C\:\\Windows\\system32\\wsmprovhost.exe)
  index: logstash-beats-*
  name: Mimikatz through Windows Remote Management
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Mimikatz through Windows Remote Management
  id: aa35a627-33fb-4d04-a165-d33b4afca3e8
  description: Detects usage of mimikatz through WinRM protocol by monitoring access to lsass process by wsmprovhost.exe.
  references:
      - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
  status: stable
  author: Patryk Prauze - ING Tech
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 10
          TargetImage: 'C:\windows\system32\lsass.exe'
          SourceImage: 'C:\Windows\system32\wsmprovhost.exe'
      condition: selection
  tags:
      - attack.credential_access
      - attack.execution
      - attack.t1003
      - attack.t1028
      - attack.s0005
  falsepositives:
      - low
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Windows Registry Persistence - COM key linking
  id: 9b0f8a61-91b2-464f-aceb-0527e0a45020
  status: experimental
  description: Detects COM object hijacking via TreatAs subkey
  references:
      - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
  author: Kutepov Anton, oscd.community
  date: 2019/10/23
  modified: 2019/11/07
  tags:
      - attack.persistence
      - attack.t1122
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 12
          TargetObject|startswith: 'HKU\'
          TargetObject|contains: '_Classes\CLSID\'
          TargetObject|endswith: '\TreatAs'
      condition: selection
  falsepositives: 
      - Maybe some system utilities in rare cases use linking keys for backward compability
  level: medium


customized_type: Issue
value:
  title: WMI Persistence - Command Line Event Consumer
  id: 05936ce2-ee05-4dae-9d03-9a391cf2d2c6
  status: experimental
  description: Detects WMI command line event consumers
  references:
      - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  author: Thomas Patzke
  date: 2018/03/07
  tags:
      - attack.t1084
      - attack.persistence
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 7
          Image: 'C:\Windows\System32\wbem\WmiPrvSE.exe'
          ImageLoaded: 'wbemcons.dll'
      condition: selection
  falsepositives: 
      - Unknown (data set is too small; further testing needed)
  level: high


customized_type: Issue
value:
  _False Positives_
  Maybe some system utilities in rare cases use linking keys for backward compability


customized_type: Issue
value:
  https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Windows Registry Persistence - COM key linking
  id: 9b0f8a61-91b2-464f-aceb-0527e0a45020
  status: experimental
  description: Detects COM object hijacking via TreatAs subkey
  references:
      - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
  author: Kutepov Anton, oscd.community
  date: 2019/10/23
  modified: 2019/11/07
  tags:
      - attack.persistence
      - attack.t1122
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 12
          TargetObject|startswith: 'HKU\'
          TargetObject|contains: '_Classes\CLSID\'
          TargetObject|endswith: '\TreatAs'
      condition: selection
  falsepositives: 
      - Maybe some system utilities in rare cases use linking keys for backward compability
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  title: WMI Persistence - Script Event Consumer File Write
  id: 33f41cdd-35ac-4ba8-814b-c6a4244a1ad4
  status: experimental
  description: Detects file writes of WMI script event consumer
  references:
      - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  author: Thomas Patzke
  date: 2018/03/07
  tags:
      - attack.t1084
      - attack.persistence
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 11
          Image: 'C:\WINDOWS\system32\wbem\scrcons.exe'
      condition: selection
  falsepositives: 
      - Unknown (data set is too small; further testing needed)
  level: high


customized_type: Issue
value:
  title: Hijack legit RDP session to move laterally
  id: 52753ea4-b3a0-4365-910d-36cff487b789
  status: experimental
  description: Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
  date: 2019/02/21
  author: Samir Bousseaden
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 11
          Image: '*\mstsc.exe'
          TargetFileName: '*\Microsoft\Windows\Start Menu\Programs\Startup\\*'
      condition: selection
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          event_data.Image:*\\mstsc.exe AND TargetFileName:*\\Microsoft\\Windows\\Start\
          Menu\\Programs\\Startup\\\\*)
  index: logstash-beats-*
  name: WMI Persistence - Script Event Consumer File Write
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WMI Persistence - Script Event Consumer File Write
  id: 33f41cdd-35ac-4ba8-814b-c6a4244a1ad4
  status: experimental
  description: Detects file writes of WMI script event consumer
  references:
      - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  author: Thomas Patzke
  date: 2018/03/07
  tags:
      - attack.t1084
      - attack.persistence
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 11
          Image: 'C:\WINDOWS\system32\wbem\scrcons.exe'
      condition: selection
  falsepositives: 
      - Unknown (data set is too small; further testing needed)
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          event_data.Image:*\\mstsc.exe AND TargetFileName:*\\Microsoft\\Windows\\Start\
          Menu\\Programs\\Startup\\\\*)
  index: logstash-beats-*
  name: Hijack legit RDP session to move laterally
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Hijack legit RDP session to move laterally
  id: 52753ea4-b3a0-4365-910d-36cff487b789
  status: experimental
  description: Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
  date: 2019/02/21
  author: Samir Bousseaden
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 11
          Image: '*\mstsc.exe'
          TargetFileName: '*\Microsoft\Windows\Start Menu\Programs\Startup\\*'
      condition: selection
  falsepositives:
      - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Registry Persistence via Explorer Run Key
  id: b7916c2a-fa2f-4795-9477-32b731f70f11
  status: experimental
  description: Detects a possible persistence mechanism using RUN key for Windows Explorer and poiting to a suspicious folder
  author: Florian Roth
  date: 2018/07/18
  references:
      - https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 13
          TargetObject: '*\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
          Details: 
              - 'C:\Windows\Temp\\*'
              - 'C:\ProgramData\\*'
              - '*\AppData\\*'
              - 'C:\$Recycle.bin\\*'
              - 'C:\Temp\\*'
              - 'C:\Users\Public\\*'
              - 'C:\Users\Default\\*'
      condition: selection
  tags:
      - attack.persistence
      - attack.t1060
      - capec.270
  fields:
      - Image
      - ParentImage
  falsepositives:
      - Unknown
  level: high


customized_type: Issue
value:
  Detects a possible persistence mechanism using RUN key for Windows Explorer and poiting to a suspicious folder


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:*\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run
          AND event_data.Details:(C\:\\Windows\\Temp\\\\* OR C\:\\ProgramData\\\\* OR
          *\\AppData\\\\* OR C\:\\$Recycle.bin\\\\* OR C\:\\Temp\\\\* OR C\:\\Users\\Public\\\\*
          OR C\:\\Users\\Default\\\\*))
  index: logstash-beats-*
  name: Registry Persistence via Explorer Run Key
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Registry Persistence via Explorer Run Key
  id: b7916c2a-fa2f-4795-9477-32b731f70f11
  status: experimental
  description: Detects a possible persistence mechanism using RUN key for Windows Explorer and poiting to a suspicious folder
  author: Florian Roth
  date: 2018/07/18
  references:
      - https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 13
          TargetObject: '*\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
          Details: 
              - 'C:\Windows\Temp\\*'
              - 'C:\ProgramData\\*'
              - '*\AppData\\*'
              - 'C:\$Recycle.bin\\*'
              - 'C:\Temp\\*'
              - 'C:\Users\Public\\*'
              - 'C:\Users\Default\\*'
      condition: selection
  tags:
      - attack.persistence
      - attack.t1060
      - capec.270
  fields:
      - Image
      - ParentImage
  falsepositives:
      - Unknown
  level: high


  </code></pre>
  }}


customized_type: Issue
value:
  title: Suspicious RUN Key from Download
  id: 9c5037d1-c568-49b3-88c7-9846a5bdc2be
  status: experimental
  description: Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories
  references:
      - https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/
  author: Florian Roth
  date: 2019/10/01
  tags:
      - attack.persistence
      - attack.t1060
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 13
          Image: 
              - '*\Downloads\\*'
              - '*\Temporary Internet Files\Content.Outlook\\*'
              - '*\Local Settings\Temporary Internet Files\\*'
          TargetObject: '*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\*'
      condition: selection
  falsepositives:
      - Software installers downloaded and used by users
  level: high


customized_type: Issue
value:
  Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.Image:(*\\Downloads\\\\* OR *\\Temporary\ Internet\ Files\\Content.Outlook\\\\*
          OR *\\Local\ Settings\\Temporary\ Internet\ Files\\\\*) AND event_data.TargetObject:*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\\\*)
  index: logstash-beats-*
  name: Suspicious RUN Key from Download
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious RUN Key from Download
  id: 9c5037d1-c568-49b3-88c7-9846a5bdc2be
  status: experimental
  description: Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories
  references:
      - https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/
  author: Florian Roth
  date: 2019/10/01
  tags:
      - attack.persistence
      - attack.t1060
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 13
          Image: 
              - '*\Downloads\\*'
              - '*\Temporary Internet Files\Content.Outlook\\*'
              - '*\Local Settings\Temporary Internet Files\\*'
          TargetObject: '*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\*'
      condition: selection
  falsepositives:
      - Software installers downloaded and used by users
  level: high
  </code></pre>
  }}


customized_type: Issue
value:
  title: CACTUSTORCH Remote Thread Creation
  id: 2e4e488a-6164-4811-9ea1-f960c7359c40
  description: Detects remote thread creation from CACTUSTORCH as described in references.
  references:
      - https://twitter.com/SBousseaden/status/1090588499517079552
      - https://github.com/mdsecactivebreach/CACTUSTORCH
  status: experimental
  author: '@SBousseaden (detection), Thomas Patzke (rule)'
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 8
          SourceImage:
              - '*\System32\cscript.exe'
              - '*\System32\wscript.exe'
              - '*\System32\mshta.exe'
              - '*\winword.exe'
              - '*\excel.exe'
          TargetImage: '*\SysWOW64\\*'
          StartModule: null
      condition: selection
  tags:
      - attack.execution
      - attack.t1055
      - attack.t1064
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:8 AND
          event_data.SourceImage:(*\\System32\\cscript.exe OR *\\System32\\wscript.exe
          OR *\\System32\\mshta.exe OR *\\winword.exe OR *\\excel.exe) AND event_data.TargetImage:*\\SysWOW64\\\\*
          AND event_data.StartModule:None)
  index: logstash-beats-*
  name: CACTUSTORCH Remote Thread Creation
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/SBousseaden/status/1090588499517079552
  https://github.com/mdsecactivebreach/CACTUSTORCH


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: CACTUSTORCH Remote Thread Creation
  id: 2e4e488a-6164-4811-9ea1-f960c7359c40
  description: Detects remote thread creation from CACTUSTORCH as described in references.
  references:
      - https://twitter.com/SBousseaden/status/1090588499517079552
      - https://github.com/mdsecactivebreach/CACTUSTORCH
  status: experimental
  author: '@SBousseaden (detection), Thomas Patzke (rule)'
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 8
          SourceImage:
              - '*\System32\cscript.exe'
              - '*\System32\wscript.exe'
              - '*\System32\mshta.exe'
              - '*\winword.exe'
              - '*\excel.exe'
          TargetImage: '*\SysWOW64\\*'
          StartModule: null
      condition: selection
  tags:
      - attack.execution
      - attack.t1055
      - attack.t1064
  falsepositives:
      - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Microsoft Binary Github Communication
  id: 635dbb88-67b3-4b41-9ea5-a3af2dd88153
  status: experimental
  description: Detects an executable in the Windows folder accessing github.com
  references:
      - https://twitter.com/M_haggis/status/900741347035889665
      - https://twitter.com/M_haggis/status/1032799638213066752
  author: Michael Haag (idea), Florian Roth (rule)
  tags:
      - attack.lateral_movement
      - attack.t1105
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          Initiated: 'true'
          DestinationHostname: 
              - '*.github.com'
              - '*.githubusercontent.com'
          Image: 'C:\Windows\\*'
      condition: selection
  falsepositives:
      - 'Unknown'
      - '@subTee in your network'
  level: high


customized_type: Issue
value:
  title: Suspicious Scripting in a WMI Consumer
  id: fe21810c-2a8c-478f-8dd3-5a287fb2a0e0
  status: experimental
  description: Detects suspicious scripting in WMI Event Consumers
  author: Florian Roth
  references:
      - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
      - https://github.com/Neo23x0/signature-base/blob/master/yara/gen_susp_lnk_files.yar#L19
  date: 2019/04/15
  tags:
      - attack.t1086
      - attack.execution
  logsource:
     product: windows
     service: sysmon
  detection:
      selection:
          EventID: 20
          Destination:
              - '*new-object system.net.webclient).downloadstring(*'
              - '*new-object system.net.webclient).downloadfile(*'
              - '*new-object net.webclient).downloadstring(*'
              - '*new-object net.webclient).downloadfile(*'
              - '* iex(*'
              - '*WScript.shell*'
              - '* -nop *'
              - '* -noprofile *'
              - '* -decode *'
              - '* -enc *'
      condition: selection
  fields:
      - CommandLine
      - ParentCommandLine
  falsepositives:
      - Administrative scripts
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:3 AND
          Initiated:true AND event_data.DestinationHostname:(*.github.com OR *.githubusercontent.com)
          AND event_data.Image:C\:\\Windows\\\\*)
  index: logstash-beats-*
  name: Microsoft Binary Github Communication
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Microsoft Binary Github Communication
  id: 635dbb88-67b3-4b41-9ea5-a3af2dd88153
  status: experimental
  description: Detects an executable in the Windows folder accessing github.com
  references:
      - https://twitter.com/M_haggis/status/900741347035889665
      - https://twitter.com/M_haggis/status/1032799638213066752
  author: Michael Haag (idea), Florian Roth (rule)
  tags:
      - attack.lateral_movement
      - attack.t1105
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          Initiated: 'true'
          DestinationHostname: 
              - '*.github.com'
              - '*.githubusercontent.com'
          Image: 'C:\Windows\\*'
      condition: selection
  falsepositives:
      - 'Unknown'
      - '@subTee in your network'
  level: high


  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:20 AND
          Destination:(*new\-object\ system.net.webclient\).downloadstring\(* OR *new\-object\
          system.net.webclient\).downloadfile\(* OR *new\-object\ net.webclient\).downloadstring\(*
          OR *new\-object\ net.webclient\).downloadfile\(* OR *\ iex\(* OR *WScript.shell*
          OR *\ \-nop\ * OR *\ \-noprofile\ * OR *\ \-decode\ * OR *\ \-enc\ *))
  index: logstash-beats-*
  name: Suspicious Scripting in a WMI Consumer
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
  https://github.com/Neo23x0/signature-base/blob/master/yara/gen_susp_lnk_files.yar#L19


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Scripting in a WMI Consumer
  id: fe21810c-2a8c-478f-8dd3-5a287fb2a0e0
  status: experimental
  description: Detects suspicious scripting in WMI Event Consumers
  author: Florian Roth
  references:
      - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
      - https://github.com/Neo23x0/signature-base/blob/master/yara/gen_susp_lnk_files.yar#L19
  date: 2019/04/15
  tags:
      - attack.t1086
      - attack.execution
  logsource:
     product: windows
     service: sysmon
  detection:
      selection:
          EventID: 20
          Destination:
              - '*new-object system.net.webclient).downloadstring(*'
              - '*new-object system.net.webclient).downloadfile(*'
              - '*new-object net.webclient).downloadstring(*'
              - '*new-object net.webclient).downloadfile(*'
              - '* iex(*'
              - '*WScript.shell*'
              - '* -nop *'
              - '* -noprofile *'
              - '* -decode *'
              - '* -enc *'
      condition: selection
  fields:
      - CommandLine
      - ParentCommandLine
  falsepositives:
      - Administrative scripts
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Suspicious Keyboard Layout Load
  id: 34aa0252-6039-40ff-951f-939fd6ce47d8
  description: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems
      maintained by US staff only
  references:
      - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
      - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files
  author: Florian Roth
  date: 2019/10/12
  modified: 2019/10/15
  logsource:
      product: windows
      service: sysmon
      definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files'
  detection:
      selection_registry:
          EventID: 13
          TargetObject: 
              - '*\Keyboard Layout\Preload\*'
              - '*\Keyboard Layout\Substitutes\*'
          Details: 
              - 00000429  # Persian (Iran)
              - 00050429  # Persian (Iran)
              - 0000042a  # Vietnamese
      condition: selection_registry
  falsepositives:
      - "Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)"
  level: medium


customized_type: Issue
value:
  Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only


customized_type: Issue
value:
  _False Positives_
  Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\Keyboard\ Layout\\Preload\\* OR *\\Keyboard\ Layout\\Substitutes\\*)
          AND event_data.Details:(429 OR 50429 OR 0000042a))
  index: logstash-beats-*
  name: Suspicious Keyboard Layout Load
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
  https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Keyboard Layout Load
  id: 34aa0252-6039-40ff-951f-939fd6ce47d8
  description: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems
      maintained by US staff only
  references:
      - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
      - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files
  author: Florian Roth
  date: 2019/10/12
  modified: 2019/10/15
  logsource:
      product: windows
      service: sysmon
      definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files'
  detection:
      selection_registry:
          EventID: 13
          TargetObject: 
              - '*\Keyboard Layout\Preload\*'
              - '*\Keyboard Layout\Substitutes\*'
          Details: 
              - 00000429  # Persian (Iran)
              - 00050429  # Persian (Iran)
              - 0000042a  # Vietnamese
      condition: selection_registry
  falsepositives:
      - "Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)"
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  title: Executable in ADS
  id: b69888d4-380c-45ce-9cf9-d9ce46e67821
  status: experimental
  description: Detects the creation of an ADS data stream that contains an executable (non-empty imphash)
  references:
      - https://twitter.com/0xrawsec/status/1002478725605273600?s=21
  tags:
      - attack.defense_evasion
      - attack.t1027
      - attack.s0139
  author: Florian Roth, @0xrawsec
  date: 2018/06/03
  logsource:
      product: windows
      service: sysmon
      definition: 'Requirements: Sysmon config with Imphash logging activated'
  detection:
      selection:
          EventID: 15
      filter:
          Imphash: '00000000000000000000000000000000'
      condition: selection and not filter
  fields:
      - TargetFilename
      - Image
  falsepositives:
      - unknown
  level: critical


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:15 AND
          (NOT (event_data.Imphash:00000000000000000000000000000000)))
  index: logstash-beats-*
  name: Executable in ADS
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Executable in ADS
  id: b69888d4-380c-45ce-9cf9-d9ce46e67821
  status: experimental
  description: Detects the creation of an ADS data stream that contains an executable (non-empty imphash)
  references:
      - https://twitter.com/0xrawsec/status/1002478725605273600?s=21
  tags:
      - attack.defense_evasion
      - attack.t1027
      - attack.s0139
  author: Florian Roth, @0xrawsec
  date: 2018/06/03
  logsource:
      product: windows
      service: sysmon
      definition: 'Requirements: Sysmon config with Imphash logging activated'
  detection:
      selection:
          EventID: 15
      filter:
          Imphash: '00000000000000000000000000000000'
      condition: selection and not filter
  fields:
      - TargetFilename
      - Image
  falsepositives:
      - unknown
  level: critical


  </code></pre>
  }}


customized_type: Issue
value:
  title: Malicious Named Pipe
  id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a
  status: experimental
  description: Detects the creation of a named pipe used by known APT malware
  references:
      - Various sources
  date: 2017/11/06
  author: Florian Roth
  logsource:
     product: windows
     service: sysmon
     definition: 'Note that you have to configure logging for PipeEvents in Symson config'
  detection:
     selection:
        EventID: 
           - 17
           - 18
        PipeName: 
           - '\isapi_http'  # Uroburos Malware Named Pipe
           - '\isapi_dg'  # Uroburos Malware Named Pipe
           - '\isapi_dg2'  # Uroburos Malware Named Pipe
           - '\sdlrpc'  # Cobra Trojan Named Pipe http://goo.gl/8rOZUX
           - '\ahexec'  # Sofacy group malware
           - '\winsession'  # Wild Neutron APT malware https://goo.gl/pivRZJ
           - '\lsassw'  # Wild Neutron APT malware https://goo.gl/pivRZJ
           - '\46a676ab7f179e511e30dd2dc41bd388'  # Project Sauron https://goo.gl/eFoP4A
           - '\9f81f59bc58452127884ce513865ed20'  # Project Sauron https://goo.gl/eFoP4A
           - '\e710f28d59aa529d6792ca6ff0ca1b34'  # Project Sauron https://goo.gl/eFoP4A
           - '\rpchlp_3'  # Project Sauron https://goo.gl/eFoP4A - Technical Analysis Input
           - '\NamePipe_MoreWindows'  # Cloud Hopper Annex B https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, US-CERT Alert - RedLeaves https://www.us-cert.gov/ncas/alerts/TA17-117A
           - '\pcheap_reuse'  # Pipe used by Equation Group malware 77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0
           - '\msagent_*'  # CS default named pipes https://github.com/Neo23x0/sigma/issues/253
           # - '\status_*'  # CS default named pipes https://github.com/Neo23x0/sigma/issues/253
     condition: selection
  tags:
      - attack.defense_evasion
      - attack.privilege_escalation
      - attack.t1055
  falsepositives:
     - Unkown
  level: critical


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:(17 OR
          18) AND event_data.PipeName:(\\isapi_http OR \\isapi_dg OR \\isapi_dg2 OR
          \\sdlrpc OR \\ahexec OR \\winsession OR \\lsassw OR \\46a676ab7f179e511e30dd2dc41bd388
          OR \\9f81f59bc58452127884ce513865ed20 OR \\e710f28d59aa529d6792ca6ff0ca1b34
          OR \\rpchlp_3 OR \\NamePipe_MoreWindows OR \\pcheap_reuse OR \\msagent_*))
  index: logstash-beats-*
  name: Malicious Named Pipe
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Malicious Named Pipe
  id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a
  status: experimental
  description: Detects the creation of a named pipe used by known APT malware
  references:
      - Various sources
  date: 2017/11/06
  author: Florian Roth
  logsource:
     product: windows
     service: sysmon
     definition: 'Note that you have to configure logging for PipeEvents in Symson config'
  detection:
     selection:
        EventID: 
           - 17
           - 18
        PipeName: 
           - '\isapi_http'  # Uroburos Malware Named Pipe
           - '\isapi_dg'  # Uroburos Malware Named Pipe
           - '\isapi_dg2'  # Uroburos Malware Named Pipe
           - '\sdlrpc'  # Cobra Trojan Named Pipe http://goo.gl/8rOZUX
           - '\ahexec'  # Sofacy group malware
           - '\winsession'  # Wild Neutron APT malware https://goo.gl/pivRZJ
           - '\lsassw'  # Wild Neutron APT malware https://goo.gl/pivRZJ
           - '\46a676ab7f179e511e30dd2dc41bd388'  # Project Sauron https://goo.gl/eFoP4A
           - '\9f81f59bc58452127884ce513865ed20'  # Project Sauron https://goo.gl/eFoP4A
           - '\e710f28d59aa529d6792ca6ff0ca1b34'  # Project Sauron https://goo.gl/eFoP4A
           - '\rpchlp_3'  # Project Sauron https://goo.gl/eFoP4A - Technical Analysis Input
           - '\NamePipe_MoreWindows'  # Cloud Hopper Annex B https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, US-CERT Alert - RedLeaves https://www.us-cert.gov/ncas/alerts/TA17-117A
           - '\pcheap_reuse'  # Pipe used by Equation Group malware 77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0
           - '\msagent_*'  # CS default named pipes https://github.com/Neo23x0/sigma/issues/253
           # - '\status_*'  # CS default named pipes https://github.com/Neo23x0/sigma/issues/253
     condition: selection
  tags:
      - attack.defense_evasion
      - attack.privilege_escalation
      - attack.t1055
  falsepositives:
     - Unkown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  title: Registry Persistence Mechanisms
  id: 36803969-5421-41ec-b92f-8500f79c23b0
  description: Detects persistence registry keys
  references:
      - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
  date: 2018/04/11
  author: Karneades
  logsource:
      product: windows
      service: sysmon
  detection:
      selection_reg1:
          EventID: 13
          TargetObject:
              - '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\\*\GlobalFlag'
              - '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\\*\ReportingMode'
              - '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\\*\MonitorProcess'
          EventType: SetValue
      condition: selection_reg1
  tags:
      - attack.privilege_escalation
      - attack.persistence
      - attack.defense_evasion
      - attack.t1183
      - car.2013-01-002
  falsepositives:
      - unknown
  level: critical


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\SOFTWARE\\Microsoft\\Windows\ NT\\CurrentVersion\\Image\
          File\ Execution\ Options\\\\*\\GlobalFlag OR *\\SOFTWARE\\Microsoft\\Windows\
          NT\\CurrentVersion\\SilentProcessExit\\\\*\\ReportingMode OR *\\SOFTWARE\\Microsoft\\Windows\
          NT\\CurrentVersion\\SilentProcessExit\\\\*\\MonitorProcess) AND event_data.EventType:SetValue)
  index: logstash-beats-*
  name: Registry Persistence Mechanisms
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Registry Persistence Mechanisms
  id: 36803969-5421-41ec-b92f-8500f79c23b0
  description: Detects persistence registry keys
  references:
      - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
  date: 2018/04/11
  author: Karneades
  logsource:
      product: windows
      service: sysmon
  detection:
      selection_reg1:
          EventID: 13
          TargetObject:
              - '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\\*\GlobalFlag'
              - '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\\*\ReportingMode'
              - '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\\*\MonitorProcess'
          EventType: SetValue
      condition: selection_reg1
  tags:
      - attack.privilege_escalation
      - attack.persistence
      - attack.defense_evasion
      - attack.t1183
      - car.2013-01-002
  falsepositives:
      - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  title: Malware Shellcode in Verclsid Target Process
  id: b7967e22-3d7e-409b-9ed5-cdae3f9243a1
  status: experimental
  description: Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro
  references:
      - https://twitter.com/JohnLaTwC/status/837743453039534080
  tags:
      - attack.defense_evasion
      - attack.privilege_escalation
      - attack.t1055
  author: John Lambert (tech), Florian Roth (rule)
  date: 2017/03/04
  logsource:
      product: windows
      service: sysmon
      definition: 'Use the following config to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
  detection:
      selection:
          EventID: 10
          TargetImage: '*\verclsid.exe'
          GrantedAccess: '0x1FFFFF'
      combination1:
          CallTrace: '*|UNKNOWN(*VBE7.DLL*'
      combination2:
          SourceImage: '*\Microsoft Office\\*'
          CallTrace: '*|UNKNOWN*'
      condition: selection and 1 of combination*
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:10 AND
          event_data.TargetImage:*\\verclsid.exe AND event_data.GrantedAccess:0x1FFFFF)
          AND (event_data.CallTrace:*|UNKNOWN\(*VBE7.DLL* OR (event_data.SourceImage:*\\Microsoft\
          Office\\\\* AND event_data.CallTrace:*|UNKNOWN*)))
  index: logstash-beats-*
  name: Malware Shellcode in Verclsid Target Process
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Malware Shellcode in Verclsid Target Process
  id: b7967e22-3d7e-409b-9ed5-cdae3f9243a1
  status: experimental
  description: Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro
  references:
      - https://twitter.com/JohnLaTwC/status/837743453039534080
  tags:
      - attack.defense_evasion
      - attack.privilege_escalation
      - attack.t1055
  author: John Lambert (tech), Florian Roth (rule)
  date: 2017/03/04
  logsource:
      product: windows
      service: sysmon
      definition: 'Use the following config to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
  detection:
      selection:
          EventID: 10
          TargetImage: '*\verclsid.exe'
          GrantedAccess: '0x1FFFFF'
      combination1:
          CallTrace: '*|UNKNOWN(*VBE7.DLL*'
      combination2:
          SourceImage: '*\Microsoft Office\\*'
          CallTrace: '*|UNKNOWN*'
      condition: selection and 1 of combination*
  falsepositives:
      - unknown
  level: high



  </code></pre>
  }}


customized_type: Issue
value:
  title: WMI Event Subscription
  id: 0f06a3a5-6a09-413f-8743-e6cf35561297
  status: experimental
  description: Detects creation of WMI event subscription persistence method
  references:
      - https://attack.mitre.org/techniques/T1084/
  tags:
      - attack.t1084
      - attack.persistence
  author: Tom Ueltschi (@c_APT_ure)
  date: 2019/01/12
  logsource:
      product: windows
      service: sysmon
  detection:
      selector:
          EventID:
              - 19
              - 20
              - 21
      condition: selector
  falsepositives:
      - exclude legitimate (vetted) use of WMI event subscription in your network
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:(19 OR
          20 OR 21))
  index: logstash-beats-*
  name: WMI Event Subscription
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WMI Event Subscription
  id: 0f06a3a5-6a09-413f-8743-e6cf35561297
  status: experimental
  description: Detects creation of WMI event subscription persistence method
  references:
      - https://attack.mitre.org/techniques/T1084/
  tags:
      - attack.t1084
      - attack.persistence
  author: Tom Ueltschi (@c_APT_ure)
  date: 2019/01/12
  logsource:
      product: windows
      service: sysmon
  detection:
      selector:
          EventID:
              - 19
              - 20
              - 21
      condition: selector
  falsepositives:
      - exclude legitimate (vetted) use of WMI event subscription in your network
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Password Dumper Remote Thread in LSASS
  id: f239b326-2f41-4d6b-9dfa-c846a60ef505
  description: Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process
      in field Process is the malicious program. A single execution can lead to hundreds of events.
  references:
      - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm
  status: stable
  author: Thomas Patzke
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 8
          TargetImage: 'C:\Windows\System32\lsass.exe'
          StartModule: null
      condition: selection
  tags:
      - attack.credential_access
      - attack.t1003
      - attack.s0005
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:8 AND
          event_data.TargetImage:C\:\\Windows\\System32\\lsass.exe AND event_data.StartModule:None)
  index: logstash-beats-*
  name: Password Dumper Remote Thread in LSASS
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Password Dumper Remote Thread in LSASS
  id: f239b326-2f41-4d6b-9dfa-c846a60ef505
  description: Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process
      in field Process is the malicious program. A single execution can lead to hundreds of events.
  references:
      - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm
  status: stable
  author: Thomas Patzke
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 8
          TargetImage: 'C:\Windows\System32\lsass.exe'
          StartModule: null
      condition: selection
  tags:
      - attack.credential_access
      - attack.t1003
      - attack.s0005
  falsepositives:
      - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Security Support Provider (SSP) added to LSA configuration
  id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc
  status: experimental
  description: Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
  references:
      - https://attack.mitre.org/techniques/T1101/
      - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/
  tags:
      - attack.persistence
      - attack.t1011
  author: iwillkeepwatch
  date: 2019/01/18
  logsource:
      product: windows
      service: sysmon
  detection:
      selection_registry:
          EventID: 13
          TargetObject: 
              - 'HKLM\System\CurrentControlSet\Control\Lsa\Security Packages'
              - 'HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Security Packages'
      exclusion_images:
          - Image: C:\Windows\system32\msiexec.exe
          - Image: C:\Windows\syswow64\MsiExec.exe
      condition: selection_registry and not exclusion_images
  falsepositives:
      - Unlikely
  level: critical


customized_type: Issue
value:
  Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:13 AND
          event_data.TargetObject:(HKLM\\System\\CurrentControlSet\\Control\\Lsa\\Security\
          Packages OR HKLM\\System\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security\
          Packages)) AND (NOT (event_data.Image:C\:\\Windows\\system32\\msiexec.exe
          OR event_data.Image:C\:\\Windows\\syswow64\\MsiExec.exe)))
  index: logstash-beats-*
  name: Security Support Provider (SSP) added to LSA configuration
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://attack.mitre.org/techniques/T1101/
  https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Security Support Provider (SSP) added to LSA configuration
  id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc
  status: experimental
  description: Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
  references:
      - https://attack.mitre.org/techniques/T1101/
      - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/
  tags:
      - attack.persistence
      - attack.t1011
  author: iwillkeepwatch
  date: 2019/01/18
  logsource:
      product: windows
      service: sysmon
  detection:
      selection_registry:
          EventID: 13
          TargetObject: 
              - 'HKLM\System\CurrentControlSet\Control\Lsa\Security Packages'
              - 'HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Security Packages'
      exclusion_images:
          - Image: C:\Windows\system32\msiexec.exe
          - Image: C:\Windows\syswow64\MsiExec.exe
      condition: selection_registry and not exclusion_images
  falsepositives:
      - Unlikely
  level: critical


  </code></pre>
  }}


customized_type: Issue
value:
  title: Renamed PsExec
  id: a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2
  status: experimental
  description: Detects the execution of a renamed PsExec often used by attackers or malware
  references:
      - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks
  author: Florian Roth
  date: 2019/05/21
  tags:
      - car.2013-05-009
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          Description: 'Execute processes remotely'
          Product: 'Sysinternals PsExec'
      filter:
          Image:
             - '*\PsExec.exe'
             - '*\PsExec64.exe'
      condition: selection and not filter
  falsepositives:
      - Software that illegaly integrates PsExec in a renamed form
      - Administrators that have renamed PsExec and no one knows why
  level: high


customized_type: Issue
value:
  _False Positives_
  Software that illegaly integrates PsExec in a renamed form
  Administrators that have renamed PsExec and no one knows why


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_data.Description:Execute\
          processes\ remotely AND event_data.Product:Sysinternals\ PsExec) AND (NOT
          (event_data.Image:(*\\PsExec.exe OR *\\PsExec64.exe))))
  index: logstash-beats-*
  name: Renamed PsExec
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Renamed PsExec
  id: a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2
  status: experimental
  description: Detects the execution of a renamed PsExec often used by attackers or malware
  references:
      - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks
  author: Florian Roth
  date: 2019/05/21
  tags:
      - car.2013-05-009
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          Description: 'Execute processes remotely'
          Product: 'Sysinternals PsExec'
      filter:
          Image:
             - '*\PsExec.exe'
             - '*\PsExec64.exe'
      condition: selection and not filter
  falsepositives:
      - Software that illegaly integrates PsExec in a renamed form
      - Administrators that have renamed PsExec and no one knows why
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Suspicious Driver Load from Temp
  id: 2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75
  description: Detects a driver load from a temporary directory
  author: Florian Roth
  tags:
      - attack.persistence
      - attack.t1050
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 6
          ImageLoaded: '*\Temp\\*'
      condition: selection
  falsepositives:
      - there is a relevant set of false positives depending on applications in the environment 
  level: medium


customized_type: Issue
value:
  _False Positives_
  there is a relevant set of false positives depending on applications in the environment


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:6 AND
          event_data.ImageLoaded:*\\Temp\\\\*)
  index: logstash-beats-*
  name: Suspicious Driver Load from Temp
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Driver Load from Temp
  id: 2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75
  description: Detects a driver load from a temporary directory
  author: Florian Roth
  tags:
      - attack.persistence
      - attack.t1050
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 6
          ImageLoaded: '*\Temp\\*'
      condition: selection
  falsepositives:
      - there is a relevant set of false positives depending on applications in the environment 
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  title: Suspicious Typical Malware Back Connect Ports
  id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
  status: experimental
  description: Detects programs that connect to typical malware back connect ports based on statistical analysis from two different sandbox system databases
  references:
      - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
  author: Florian Roth
  date: 2017/03/19
  tags:
      - attack.command_and_control
      - attack.t1043
  logsource:
      product: windows
      service: sysmon
      definition: 'Use the following config to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
  detection:
      selection:
          EventID: 3
          Initiated: 'true'
          DestinationPort:
              - '4443'
              - '2448'
              - '8143'
              - '1777'
              - '1443'
              - '243'
              - '65535'
              - '13506'
              - '3360'
              - '200'
              - '198'
              - '49180'
              - '13507'
              - '6625'
              - '4444'
              - '4438'
              - '1904'
              - '13505'
              - '13504'
              - '12102'
              - '9631'
              - '5445'
              - '2443'
              - '777'
              - '13394'
              - '13145'
              - '12103'
              - '5552'
              - '3939'
              - '3675'
              - '666'
              - '473'
              - '5649'
              - '4455'
              - '4433'
              - '1817'
              - '100'
              - '65520'
              - '1960'
              - '1515'
              - '743'
              - '700'
              - '14154'
              - '14103'
              - '14102'
              - '12322'
              - '10101'
              - '7210'
              - '4040'
              - '9943'
      filter1:
          Image: '*\Program Files*'
      filter2:
          DestinationIp: 
              - '10.*'
              - '192.168.*'
              - '172.16.*'
              - '172.17.*'
              - '172.18.*'
              - '172.19.*'
              - '172.20.*'
              - '172.21.*'
              - '172.22.*'
              - '172.23.*'
              - '172.24.*'
              - '172.25.*'
              - '172.26.*'
              - '172.27.*'
              - '172.28.*'
              - '172.29.*'
              - '172.30.*'
              - '172.31.*'
              - '127.*'
          DestinationIsIpv6: 'false'
      condition: selection and not ( filter1 or filter2 )
  falsepositives:
      - unknown
  level: medium


customized_type: Issue
value:
  Detects programs that connect to typical malware back connect ports based on statistical analysis from two different sandbox system databases


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:3 AND
          Initiated:true AND event_data.DestinationPort:(4443 OR 2448 OR 8143 OR 1777
          OR 1443 OR 243 OR 65535 OR 13506 OR 3360 OR 200 OR 198 OR 49180 OR 13507 OR
          6625 OR 4444 OR 4438 OR 1904 OR 13505 OR 13504 OR 12102 OR 9631 OR 5445 OR
          2443 OR 777 OR 13394 OR 13145 OR 12103 OR 5552 OR 3939 OR 3675 OR 666 OR 473
          OR 5649 OR 4455 OR 4433 OR 1817 OR 100 OR 65520 OR 1960 OR 1515 OR 743 OR
          700 OR 14154 OR 14103 OR 14102 OR 12322 OR 10101 OR 7210 OR 4040 OR 9943))
          AND (NOT ((log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_data.Image:*\\Program\
          Files* OR (event_data.DestinationIp:(10.* OR 192.168.* OR 172.16.* OR 172.17.*
          OR 172.18.* OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR
          172.24.* OR 172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.*
          OR 172.31.* OR 127.*) AND event_data.DestinationIsIpv6:false))))))
  index: logstash-beats-*
  name: Suspicious Typical Malware Back Connect Ports
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Typical Malware Back Connect Ports
  id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
  status: experimental
  description: Detects programs that connect to typical malware back connect ports based on statistical analysis from two different sandbox system databases
  references:
      - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
  author: Florian Roth
  date: 2017/03/19
  tags:
      - attack.command_and_control
      - attack.t1043
  logsource:
      product: windows
      service: sysmon
      definition: 'Use the following config to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
  detection:
      selection:
          EventID: 3
          Initiated: 'true'
          DestinationPort:
              - '4443'
              - '2448'
              - '8143'
              - '1777'
              - '1443'
              - '243'
              - '65535'
              - '13506'
              - '3360'
              - '200'
              - '198'
              - '49180'
              - '13507'
              - '6625'
              - '4444'
              - '4438'
              - '1904'
              - '13505'
              - '13504'
              - '12102'
              - '9631'
              - '5445'
              - '2443'
              - '777'
              - '13394'
              - '13145'
              - '12103'
              - '5552'
              - '3939'
              - '3675'
              - '666'
              - '473'
              - '5649'
              - '4455'
              - '4433'
              - '1817'
              - '100'
              - '65520'
              - '1960'
              - '1515'
              - '743'
              - '700'
              - '14154'
              - '14103'
              - '14102'
              - '12322'
              - '10101'
              - '7210'
              - '4040'
              - '9943'
      filter1:
          Image: '*\Program Files*'
      filter2:
          DestinationIp: 
              - '10.*'
              - '192.168.*'
              - '172.16.*'
              - '172.17.*'
              - '172.18.*'
              - '172.19.*'
              - '172.20.*'
              - '172.21.*'
              - '172.22.*'
              - '172.23.*'
              - '172.24.*'
              - '172.25.*'
              - '172.26.*'
              - '172.27.*'
              - '172.28.*'
              - '172.29.*'
              - '172.30.*'
              - '172.31.*'
              - '127.*'
          DestinationIsIpv6: 'false'
      condition: selection and not ( filter1 or filter2 )
  falsepositives:
      - unknown
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  title: Malicious PowerShell Commandlet Names
  id: f331aa1f-8c53-4fc3-b083-cc159bc971cb
  status: experimental
  description: Detects the creation of known powershell scripts for exploitation
  references:
      - https://raw.githubusercontent.com/Neo23x0/sigma/f35c50049fa896dff91ff545cb199319172701e8/rules/windows/powershell/powershell_malicious_commandlets.yml
  tags:
      - attack.execution
      - attack.t1086
  author: Markus Neis
  date: 2018/04/07
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 11
          TargetFilename:
              - '*\Invoke-DllInjection.ps1'   
              - '*\Invoke-WmiCommand.ps1'
              - '*\Get-GPPPassword.ps1'
              - '*\Get-Keystrokes.ps1'
              - '*\Get-VaultCredential.ps1'
              - '*\Invoke-CredentialInjection.ps1'
              - '*\Invoke-Mimikatz.ps1'
              - '*\Invoke-NinjaCopy.ps1'
              - '*\Invoke-TokenManipulation.ps1'
              - '*\Out-Minidump.ps1'
              - '*\VolumeShadowCopyTools.ps1'
              - '*\Invoke-ReflectivePEInjection.ps1'
              - '*\Get-TimedScreenshot.ps1'
              - '*\Invoke-UserHunter.ps1'
              - '*\Find-GPOLocation.ps1'
              - '*\Invoke-ACLScanner.ps1'
              - '*\Invoke-DowngradeAccount.ps1'
              - '*\Get-ServiceUnquoted.ps1'
              - '*\Get-ServiceFilePermission.ps1'
              - '*\Get-ServicePermission.ps1'
              - '*\Invoke-ServiceAbuse.ps1'
              - '*\Install-ServiceBinary.ps1'
              - '*\Get-RegAutoLogon.ps1'
              - '*\Get-VulnAutoRun.ps1'
              - '*\Get-VulnSchTask.ps1'
              - '*\Get-UnattendedInstallFile.ps1'
              - '*\Get-WebConfig.ps1'
              - '*\Get-ApplicationHost.ps1'
              - '*\Get-RegAlwaysInstallElevated.ps1'
              - '*\Get-Unconstrained.ps1'
              - '*\Add-RegBackdoor.ps1'
              - '*\Add-ScrnSaveBackdoor.ps1'
              - '*\Gupt-Backdoor.ps1'
              - '*\Invoke-ADSBackdoor.ps1'
              - '*\Enabled-DuplicateToken.ps1'
              - '*\Invoke-PsUaCme.ps1'
              - '*\Remove-Update.ps1'
              - '*\Check-VM.ps1'
              - '*\Get-LSASecret.ps1'
              - '*\Get-PassHashes.ps1'
              - '*\Show-TargetScreen.ps1'
              - '*\Port-Scan.ps1'
              - '*\Invoke-PoshRatHttp.ps1'
              - '*\Invoke-PowerShellTCP.ps1'
              - '*\Invoke-PowerShellWMI.ps1'
              - '*\Add-Exfiltration.ps1'
              - '*\Add-Persistence.ps1'
              - '*\Do-Exfiltration.ps1'
              - '*\Start-CaptureServer.ps1'
              - '*\Invoke-ShellCode.ps1'
              - '*\Get-ChromeDump.ps1'
              - '*\Get-ClipboardContents.ps1'
              - '*\Get-FoxDump.ps1'
              - '*\Get-IndexedItem.ps1'
              - '*\Get-Screenshot.ps1'
              - '*\Invoke-Inveigh.ps1'
              - '*\Invoke-NetRipper.ps1'
              - '*\Invoke-EgressCheck.ps1'
              - '*\Invoke-PostExfil.ps1'
              - '*\Invoke-PSInject.ps1'
              - '*\Invoke-RunAs.ps1'
              - '*\MailRaider.ps1'
              - '*\New-HoneyHash.ps1'
              - '*\Set-MacAttribute.ps1'
              - '*\Invoke-DCSync.ps1'
              - '*\Invoke-PowerDump.ps1'
              - '*\Exploit-Jboss.ps1'
              - '*\Invoke-ThunderStruck.ps1'
              - '*\Invoke-VoiceTroll.ps1'
              - '*\Set-Wallpaper.ps1'
              - '*\Invoke-InveighRelay.ps1'
              - '*\Invoke-PsExec.ps1'
              - '*\Invoke-SSHCommand.ps1'
              - '*\Get-SecurityPackages.ps1'
              - '*\Install-SSP.ps1'
              - '*\Invoke-BackdoorLNK.ps1'
              - '*\PowerBreach.ps1'
              - '*\Get-SiteListPassword.ps1'
              - '*\Get-System.ps1'
              - '*\Invoke-BypassUAC.ps1'
              - '*\Invoke-Tater.ps1'
              - '*\Invoke-WScriptBypassUAC.ps1'
              - '*\PowerUp.ps1'
              - '*\PowerView.ps1'
              - '*\Get-RickAstley.ps1'
              - '*\Find-Fruit.ps1'
              - '*\HTTP-Login.ps1'
              - '*\Find-TrustedDocuments.ps1'
              - '*\Invoke-Paranoia.ps1'
              - '*\Invoke-WinEnum.ps1'
              - '*\Invoke-ARPScan.ps1'
              - '*\Invoke-PortScan.ps1'
              - '*\Invoke-ReverseDNSLookup.ps1'
              - '*\Invoke-SMBScanner.ps1'
              - '*\Invoke-Mimikittenz.ps1'
      condition: selection
  falsepositives:
      - Penetration Tests
  level: high
          


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          event_data.TargetFilename:(*\\Invoke\-DllInjection.ps1 OR *\\Invoke\-WmiCommand.ps1
          OR *\\Get\-GPPPassword.ps1 OR *\\Get\-Keystrokes.ps1 OR *\\Get\-VaultCredential.ps1
          OR *\\Invoke\-CredentialInjection.ps1 OR *\\Invoke\-Mimikatz.ps1 OR *\\Invoke\-NinjaCopy.ps1
          OR *\\Invoke\-TokenManipulation.ps1 OR *\\Out\-Minidump.ps1 OR *\\VolumeShadowCopyTools.ps1
          OR *\\Invoke\-ReflectivePEInjection.ps1 OR *\\Get\-TimedScreenshot.ps1 OR
          *\\Invoke\-UserHunter.ps1 OR *\\Find\-GPOLocation.ps1 OR *\\Invoke\-ACLScanner.ps1
          OR *\\Invoke\-DowngradeAccount.ps1 OR *\\Get\-ServiceUnquoted.ps1 OR *\\Get\-ServiceFilePermission.ps1
          OR *\\Get\-ServicePermission.ps1 OR *\\Invoke\-ServiceAbuse.ps1 OR *\\Install\-ServiceBinary.ps1
          OR *\\Get\-RegAutoLogon.ps1 OR *\\Get\-VulnAutoRun.ps1 OR *\\Get\-VulnSchTask.ps1
          OR *\\Get\-UnattendedInstallFile.ps1 OR *\\Get\-WebConfig.ps1 OR *\\Get\-ApplicationHost.ps1
          OR *\\Get\-RegAlwaysInstallElevated.ps1 OR *\\Get\-Unconstrained.ps1 OR *\\Add\-RegBackdoor.ps1
          OR *\\Add\-ScrnSaveBackdoor.ps1 OR *\\Gupt\-Backdoor.ps1 OR *\\Invoke\-ADSBackdoor.ps1
          OR *\\Enabled\-DuplicateToken.ps1 OR *\\Invoke\-PsUaCme.ps1 OR *\\Remove\-Update.ps1
          OR *\\Check\-VM.ps1 OR *\\Get\-LSASecret.ps1 OR *\\Get\-PassHashes.ps1 OR
          *\\Show\-TargetScreen.ps1 OR *\\Port\-Scan.ps1 OR *\\Invoke\-PoshRatHttp.ps1
          OR *\\Invoke\-PowerShellTCP.ps1 OR *\\Invoke\-PowerShellWMI.ps1 OR *\\Add\-Exfiltration.ps1
          OR *\\Add\-Persistence.ps1 OR *\\Do\-Exfiltration.ps1 OR *\\Start\-CaptureServer.ps1
          OR *\\Invoke\-ShellCode.ps1 OR *\\Get\-ChromeDump.ps1 OR *\\Get\-ClipboardContents.ps1
          OR *\\Get\-FoxDump.ps1 OR *\\Get\-IndexedItem.ps1 OR *\\Get\-Screenshot.ps1
          OR *\\Invoke\-Inveigh.ps1 OR *\\Invoke\-NetRipper.ps1 OR *\\Invoke\-EgressCheck.ps1
          OR *\\Invoke\-PostExfil.ps1 OR *\\Invoke\-PSInject.ps1 OR *\\Invoke\-RunAs.ps1
          OR *\\MailRaider.ps1 OR *\\New\-HoneyHash.ps1 OR *\\Set\-MacAttribute.ps1
          OR *\\Invoke\-DCSync.ps1 OR *\\Invoke\-PowerDump.ps1 OR *\\Exploit\-Jboss.ps1
          OR *\\Invoke\-ThunderStruck.ps1 OR *\\Invoke\-VoiceTroll.ps1 OR *\\Set\-Wallpaper.ps1
          OR *\\Invoke\-InveighRelay.ps1 OR *\\Invoke\-PsExec.ps1 OR *\\Invoke\-SSHCommand.ps1
          OR *\\Get\-SecurityPackages.ps1 OR *\\Install\-SSP.ps1 OR *\\Invoke\-BackdoorLNK.ps1
          OR *\\PowerBreach.ps1 OR *\\Get\-SiteListPassword.ps1 OR *\\Get\-System.ps1
          OR *\\Invoke\-BypassUAC.ps1 OR *\\Invoke\-Tater.ps1 OR *\\Invoke\-WScriptBypassUAC.ps1
          OR *\\PowerUp.ps1 OR *\\PowerView.ps1 OR *\\Get\-RickAstley.ps1 OR *\\Find\-Fruit.ps1
          OR *\\HTTP\-Login.ps1 OR *\\Find\-TrustedDocuments.ps1 OR *\\Invoke\-Paranoia.ps1
          OR *\\Invoke\-WinEnum.ps1 OR *\\Invoke\-ARPScan.ps1 OR *\\Invoke\-PortScan.ps1
          OR *\\Invoke\-ReverseDNSLookup.ps1 OR *\\Invoke\-SMBScanner.ps1 OR *\\Invoke\-Mimikittenz.ps1))
  index: logstash-beats-*
  name: Malicious PowerShell Commandlet Names
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://raw.githubusercontent.com/Neo23x0/sigma/f35c50049fa896dff91ff545cb199319172701e8/rules/windows/powershell/powershell_malicious_commandlets.yml


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Malicious PowerShell Commandlet Names
  id: f331aa1f-8c53-4fc3-b083-cc159bc971cb
  status: experimental
  description: Detects the creation of known powershell scripts for exploitation
  references:
      - https://raw.githubusercontent.com/Neo23x0/sigma/f35c50049fa896dff91ff545cb199319172701e8/rules/windows/powershell/powershell_malicious_commandlets.yml
  tags:
      - attack.execution
      - attack.t1086
  author: Markus Neis
  date: 2018/04/07
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 11
          TargetFilename:
              - '*\Invoke-DllInjection.ps1'   
              - '*\Invoke-WmiCommand.ps1'
              - '*\Get-GPPPassword.ps1'
              - '*\Get-Keystrokes.ps1'
              - '*\Get-VaultCredential.ps1'
              - '*\Invoke-CredentialInjection.ps1'
              - '*\Invoke-Mimikatz.ps1'
              - '*\Invoke-NinjaCopy.ps1'
              - '*\Invoke-TokenManipulation.ps1'
              - '*\Out-Minidump.ps1'
              - '*\VolumeShadowCopyTools.ps1'
              - '*\Invoke-ReflectivePEInjection.ps1'
              - '*\Get-TimedScreenshot.ps1'
              - '*\Invoke-UserHunter.ps1'
              - '*\Find-GPOLocation.ps1'
              - '*\Invoke-ACLScanner.ps1'
              - '*\Invoke-DowngradeAccount.ps1'
              - '*\Get-ServiceUnquoted.ps1'
              - '*\Get-ServiceFilePermission.ps1'
              - '*\Get-ServicePermission.ps1'
              - '*\Invoke-ServiceAbuse.ps1'
              - '*\Install-ServiceBinary.ps1'
              - '*\Get-RegAutoLogon.ps1'
              - '*\Get-VulnAutoRun.ps1'
              - '*\Get-VulnSchTask.ps1'
              - '*\Get-UnattendedInstallFile.ps1'
              - '*\Get-WebConfig.ps1'
              - '*\Get-ApplicationHost.ps1'
              - '*\Get-RegAlwaysInstallElevated.ps1'
              - '*\Get-Unconstrained.ps1'
              - '*\Add-RegBackdoor.ps1'
              - '*\Add-ScrnSaveBackdoor.ps1'
              - '*\Gupt-Backdoor.ps1'
              - '*\Invoke-ADSBackdoor.ps1'
              - '*\Enabled-DuplicateToken.ps1'
              - '*\Invoke-PsUaCme.ps1'
              - '*\Remove-Update.ps1'
              - '*\Check-VM.ps1'
              - '*\Get-LSASecret.ps1'
              - '*\Get-PassHashes.ps1'
              - '*\Show-TargetScreen.ps1'
              - '*\Port-Scan.ps1'
              - '*\Invoke-PoshRatHttp.ps1'
              - '*\Invoke-PowerShellTCP.ps1'
              - '*\Invoke-PowerShellWMI.ps1'
              - '*\Add-Exfiltration.ps1'
              - '*\Add-Persistence.ps1'
              - '*\Do-Exfiltration.ps1'
              - '*\Start-CaptureServer.ps1'
              - '*\Invoke-ShellCode.ps1'
              - '*\Get-ChromeDump.ps1'
              - '*\Get-ClipboardContents.ps1'
              - '*\Get-FoxDump.ps1'
              - '*\Get-IndexedItem.ps1'
              - '*\Get-Screenshot.ps1'
              - '*\Invoke-Inveigh.ps1'
              - '*\Invoke-NetRipper.ps1'
              - '*\Invoke-EgressCheck.ps1'
              - '*\Invoke-PostExfil.ps1'
              - '*\Invoke-PSInject.ps1'
              - '*\Invoke-RunAs.ps1'
              - '*\MailRaider.ps1'
              - '*\New-HoneyHash.ps1'
              - '*\Set-MacAttribute.ps1'
              - '*\Invoke-DCSync.ps1'
              - '*\Invoke-PowerDump.ps1'
              - '*\Exploit-Jboss.ps1'
              - '*\Invoke-ThunderStruck.ps1'
              - '*\Invoke-VoiceTroll.ps1'
              - '*\Set-Wallpaper.ps1'
              - '*\Invoke-InveighRelay.ps1'
              - '*\Invoke-PsExec.ps1'
              - '*\Invoke-SSHCommand.ps1'
              - '*\Get-SecurityPackages.ps1'
              - '*\Install-SSP.ps1'
              - '*\Invoke-BackdoorLNK.ps1'
              - '*\PowerBreach.ps1'
              - '*\Get-SiteListPassword.ps1'
              - '*\Get-System.ps1'
              - '*\Invoke-BypassUAC.ps1'
              - '*\Invoke-Tater.ps1'
              - '*\Invoke-WScriptBypassUAC.ps1'
              - '*\PowerUp.ps1'
              - '*\PowerView.ps1'
              - '*\Get-RickAstley.ps1'
              - '*\Find-Fruit.ps1'
              - '*\HTTP-Login.ps1'
              - '*\Find-TrustedDocuments.ps1'
              - '*\Invoke-Paranoia.ps1'
              - '*\Invoke-WinEnum.ps1'
              - '*\Invoke-ARPScan.ps1'
              - '*\Invoke-PortScan.ps1'
              - '*\Invoke-ReverseDNSLookup.ps1'
              - '*\Invoke-SMBScanner.ps1'
              - '*\Invoke-Mimikittenz.ps1'
      condition: selection
  falsepositives:
      - Penetration Tests
  level: high
          

  </code></pre>
  }}


customized_type: Issue
value:
  title: UAC Bypass via Event Viewer
  id: 7c81fec3-1c1d-43b0-996a-46753041b1b6
  status: experimental
  description: Detects UAC bypass method using Windows event viewer
  references:
      - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
      - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100
  author: Florian Roth
  logsource:
      product: windows
      service: sysmon
  detection:
      methregistry:
          EventID: 13
          TargetObject: 'HKEY_USERS\\*\mscfile\shell\open\command'
      methprocess:
          EventID: 1 # Migration to process_creation requires multipart YAML
          ParentImage: '*\eventvwr.exe'
      filterprocess:
          Image: '*\mmc.exe'
      condition: methregistry or ( methprocess and not filterprocess )
  fields:
      - CommandLine
      - ParentCommandLine
  tags:
      - attack.defense_evasion
      - attack.privilege_escalation
      - attack.t1088
      - car.2019-04-001
  falsepositives:
      - unknown
  level: critical


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND ((event_id:13 AND
          event_data.TargetObject:HKEY_USERS\\\\*\\mscfile\\shell\\open\\command) OR
          (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:1 AND event_data.ParentImage:*\\eventvwr.exe)
          AND (NOT (event_data.Image:*\\mmc.exe)))))
  index: logstash-beats-*
  name: UAC Bypass via Event Viewer
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: UAC Bypass via Event Viewer
  id: 7c81fec3-1c1d-43b0-996a-46753041b1b6
  status: experimental
  description: Detects UAC bypass method using Windows event viewer
  references:
      - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
      - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100
  author: Florian Roth
  logsource:
      product: windows
      service: sysmon
  detection:
      methregistry:
          EventID: 13
          TargetObject: 'HKEY_USERS\\*\mscfile\shell\open\command'
      methprocess:
          EventID: 1 # Migration to process_creation requires multipart YAML
          ParentImage: '*\eventvwr.exe'
      filterprocess:
          Image: '*\mmc.exe'
      condition: methregistry or ( methprocess and not filterprocess )
  fields:
      - CommandLine
      - ParentCommandLine
  tags:
      - attack.defense_evasion
      - attack.privilege_escalation
      - attack.t1088
      - car.2019-04-001
  falsepositives:
      - unknown
  level: critical
  </code></pre>
  }}


customized_type: Issue
value:
  title: Windows webshell creation
  id: 39f1f9f2-9636-45de-98f6-a4046aa8e4b9
  status: experimental
  description: Posible webshell file creation on a static web site
  references:
      - PT ESC rule and personal experience
  author: Beyu Denis, oscd.community
  date: 2019/10/22
  modified: 2019/11/04
  tags:
      - attack.persistence
      - attack.t1100
  level: critical
  logsource:
      product: windows
      service: sysmon
  detection:
      selection_1:
          EventID: 11
      selection_2:
          TargetFilename|contains: '\inetpub\wwwroot\'
      selection_3:        
          TargetFilename|contains:
              - '.asp'
              - '.ashx'
              - '.ph'
      selection_4: 
          TargetFilename|contains:
              - '\www\'
              - '\htdocs\'
              - '\html\'
      selection_5:
          TargetFilename|contains: '.ph'
      selection_6:
          - TargetFilename|contains|all: 
              - '\'
              - '.jsp'
          - TargetFilename|contains|all: 
              - '\cgi-bin\'
              - '.pl'
      condition: selection_1 and ( selection_2 and selection_3 ) or
                 selection_1 and ( selection_4 and selection_5 ) or
                 selection_1 and selection_6
  falsepositives:
      - Legitimate administrator or developer creating legitimate executable files in a web application folder


customized_type: Issue
value:
  _False Positives_
  Legitimate administrator or developer creating legitimate executable files in a web application folder


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          ((log_name:Microsoft\-Windows\-Sysmon\/Operational AND ((event_data.TargetFilename:*\\inetpub\\wwwroot\\*
          AND event_data.TargetFilename:(*.asp* OR *.ashx* OR *.ph*)) OR (event_data.TargetFilename:(*\\www\\*
          OR *\\htdocs\\* OR *\\html\\*) AND event_data.TargetFilename:*.ph*))) OR ((event_data.TargetFilename:*\\*
          AND event_data.TargetFilename:*.jsp*) OR (event_data.TargetFilename:*\\cgi\-bin\\*
          AND event_data.TargetFilename:*.pl*))))
  index: logstash-beats-*
  name: Windows webshell creation
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Windows webshell creation
  id: 39f1f9f2-9636-45de-98f6-a4046aa8e4b9
  status: experimental
  description: Posible webshell file creation on a static web site
  references:
      - PT ESC rule and personal experience
  author: Beyu Denis, oscd.community
  date: 2019/10/22
  modified: 2019/11/04
  tags:
      - attack.persistence
      - attack.t1100
  level: critical
  logsource:
      product: windows
      service: sysmon
  detection:
      selection_1:
          EventID: 11
      selection_2:
          TargetFilename|contains: '\inetpub\wwwroot\'
      selection_3:        
          TargetFilename|contains:
              - '.asp'
              - '.ashx'
              - '.ph'
      selection_4: 
          TargetFilename|contains:
              - '\www\'
              - '\htdocs\'
              - '\html\'
      selection_5:
          TargetFilename|contains: '.ph'
      selection_6:
          - TargetFilename|contains|all: 
              - '\'
              - '.jsp'
          - TargetFilename|contains|all: 
              - '\cgi-bin\'
              - '.pl'
      condition: selection_1 and ( selection_2 and selection_3 ) or
                 selection_1 and ( selection_4 and selection_5 ) or
                 selection_1 and selection_6
  falsepositives:
      - Legitimate administrator or developer creating legitimate executable files in a web application folder

  </code></pre>
  }}


customized_type: Issue
value:
  title: Mimikatz In-Memory
  id: c0478ead-5336-46c2-bd5e-b4c84bc3a36e
  status: experimental
  description: Detects certain DLL loads when Mimikatz gets executed
  references:
      - https://securityriskadvisors.com/blog/post/detecting-in-memory-mimikatz/
  tags:
      - attack.s0002
      - attack.t1003
      - attack.lateral_movement
      - attack.credential_access
      - car.2019-04-004
  logsource:
      product: windows
      service: sysmon
  detection:
      selector:
          EventID: 7
          Image: 'C:\Windows\System32\rundll32.exe'
      dllload1:
          ImageLoaded: '*\vaultcli.dll'
      dllload2:
          ImageLoaded: '*\wlanapi.dll'        
      exclusion:
          ImageLoaded:
              - 'ntdsapi.dll'
              - 'netapi32.dll'
              - 'imm32.dll'
              - 'samlib.dll'
              - 'combase.dll'
              - 'srvcli.dll'
              - 'shcore.dll'
              - 'ntasn1.dll'
              - 'cryptdll.dll'
              - 'logoncli.dll'
      timeframe: 30s
      condition: selector | near dllload1 and dllload2 and not exclusion
  falsepositives:
      - unknown
  level: medium


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Mimikatz In-Memory
  id: c0478ead-5336-46c2-bd5e-b4c84bc3a36e
  status: experimental
  description: Detects certain DLL loads when Mimikatz gets executed
  references:
      - https://securityriskadvisors.com/blog/post/detecting-in-memory-mimikatz/
  tags:
      - attack.s0002
      - attack.t1003
      - attack.lateral_movement
      - attack.credential_access
      - car.2019-04-004
  logsource:
      product: windows
      service: sysmon
  detection:
      selector:
          EventID: 7
          Image: 'C:\Windows\System32\rundll32.exe'
      dllload1:
          ImageLoaded: '*\vaultcli.dll'
      dllload2:
          ImageLoaded: '*\wlanapi.dll'        
      exclusion:
          ImageLoaded:
              - 'ntdsapi.dll'
              - 'netapi32.dll'
              - 'imm32.dll'
              - 'samlib.dll'
              - 'combase.dll'
              - 'srvcli.dll'
              - 'shcore.dll'
              - 'ntasn1.dll'
              - 'cryptdll.dll'
              - 'logoncli.dll'
      timeframe: 30s
      condition: selector | near dllload1 and dllload2 and not exclusion
  falsepositives:
      - unknown
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  title: Suspicious File Characteristics due to Missing Fields
  id: 9637e8a5-7131-4f7f-bdc7-2b05d8670c43
  description: Detects Executables without FileVersion,Description,Product,Company likely created with py2exe
  status: experimental
  references:
      - https://securelist.com/muddywater/88059/
      - https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection
  author: Markus Neis
  date: 2018/11/22
  modified: 2019/11/09
  tags:
      - attack.defense_evasion
      - attack.execution
      - attack.t1064
  logsource:
      product: windows
      service: sysmon
  detection:
      selection1:
          Description: '\?'
          FileVersion: '\?'
      selection2:
          Description: '\?'
          Product: '\?'
      selection3:
          Description: '\?'
          Company: '\?' 
      condition: 1 of them
  fields:
      - CommandLine
      - ParentCommandLine
  falsepositives:
      - Unknown
  level: medium


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_data.Description:\\?
          AND (FileVersion:\\? OR event_data.Product:\\? OR event_data.Company:\\?))
  index: logstash-beats-*
  name: Suspicious File Characteristics due to Missing Fields
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://securelist.com/muddywater/88059/
  https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious File Characteristics due to Missing Fields
  id: 9637e8a5-7131-4f7f-bdc7-2b05d8670c43
  description: Detects Executables without FileVersion,Description,Product,Company likely created with py2exe
  status: experimental
  references:
      - https://securelist.com/muddywater/88059/
      - https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection
  author: Markus Neis
  date: 2018/11/22
  modified: 2019/11/09
  tags:
      - attack.defense_evasion
      - attack.execution
      - attack.t1064
  logsource:
      product: windows
      service: sysmon
  detection:
      selection1:
          Description: '\?'
          FileVersion: '\?'
      selection2:
          Description: '\?'
          Product: '\?'
      selection3:
          Description: '\?'
          Company: '\?' 
      condition: 1 of them
  fields:
      - CommandLine
      - ParentCommandLine
  falsepositives:
      - Unknown
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:7 AND
          event_data.Image:C\:\\Windows\\System32\\wbem\\WmiPrvSE.exe AND event_data.ImageLoaded:wbemcons.dll)
  index: logstash-beats-*
  name: WMI Persistence - Command Line Event Consumer
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WMI Persistence - Command Line Event Consumer
  id: 05936ce2-ee05-4dae-9d03-9a391cf2d2c6
  status: experimental
  description: Detects WMI command line event consumers
  references:
      - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  author: Thomas Patzke
  date: 2018/03/07
  tags:
      - attack.t1084
      - attack.persistence
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 7
          Image: 'C:\Windows\System32\wbem\WmiPrvSE.exe'
          ImageLoaded: 'wbemcons.dll'
      condition: selection
  falsepositives: 
      - Unknown (data set is too small; further testing needed)
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Svchost DLL Search Order Hijack
  id: 602a1f13-c640-4d73-b053-be9a2fa58b77
  status: experimental
  description: IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default. An attacker can place their
      malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a
      remote machine.
  references:
      - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
  author: SBousseaden
  date: 2019/10/28
  tags:
      - attack.persistence
      - attack.defense_evasion
      - attack.t1073
      - attack.t1038
      - attack.t1112
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 7
          Image:
              - '*\svchost.exe'
          ImageLoaded:
              - '*\tsmsisrv.dll'
              - '*\tsvipsrv.dll'
              - '*\wlbsctrl.dll'
      filter:
          EventID: 7
          Image:
              - '*\svchost.exe'
          ImageLoaded:
              - 'C:\Windows\WinSxS\*'        
      condition: selection and not filter
  falsepositives:
      - Pentest
  level: high


customized_type: Issue
value:
  IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default. An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:7 AND
          event_data.Image:(*\\svchost.exe) AND event_data.ImageLoaded:(*\\tsmsisrv.dll
          OR *\\tsvipsrv.dll OR *\\wlbsctrl.dll)) AND (NOT (event_id:7 AND event_data.Image:(*\\svchost.exe)
          AND event_data.ImageLoaded:(C\:\\Windows\\WinSxS\\*))))
  index: logstash-beats-*
  name: Svchost DLL Search Order Hijack
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Svchost DLL Search Order Hijack
  id: 602a1f13-c640-4d73-b053-be9a2fa58b77
  status: experimental
  description: IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default. An attacker can place their
      malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a
      remote machine.
  references:
      - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
  author: SBousseaden
  date: 2019/10/28
  tags:
      - attack.persistence
      - attack.defense_evasion
      - attack.t1073
      - attack.t1038
      - attack.t1112
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 7
          Image:
              - '*\svchost.exe'
          ImageLoaded:
              - '*\tsmsisrv.dll'
              - '*\tsvipsrv.dll'
              - '*\wlbsctrl.dll'
      filter:
          EventID: 7
          Image:
              - '*\svchost.exe'
          ImageLoaded:
              - 'C:\Windows\WinSxS\*'        
      condition: selection and not filter
  falsepositives:
      - Pentest
  level: high
  </code></pre>
  }}


customized_type: Issue
value:
  title: Suspicious Program Location with Network Connections
  id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
  status: experimental
  description: Detects programs with network connections running in suspicious files system locations
  references:
      - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
  author: Florian Roth
  date: 2017/03/19
  logsource:
      product: windows
      service: sysmon
      definition: 'Use the following config to generate the necessary Event ID 3 Network Connection events'
  detection:
      selection:
          EventID: 3
          Image: 
              # - '*\ProgramData\\*'  # too many false positives, e.g. with Webex for Windows
              - '*\$Recycle.bin'
              - '*\Users\All Users\\*'
              - '*\Users\Default\\*'
              - '*\Users\Public\\*'
              - '*\Users\Contacts\\*'
              - '*\Users\Searches\\*' 
              - 'C:\Perflogs\\*'
              - '*\config\systemprofile\\*'
              - '*\Windows\Fonts\\*'
              - '*\Windows\IME\\*'
              - '*\Windows\addins\\*'
      condition: selection
  falsepositives:
      - unknown
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:3 AND
          event_data.Image:(*\\$Recycle.bin OR *\\Users\\All\ Users\\\\* OR *\\Users\\Default\\\\*
          OR *\\Users\\Public\\\\* OR *\\Users\\Contacts\\\\* OR *\\Users\\Searches\\\\*
          OR C\:\\Perflogs\\\\* OR *\\config\\systemprofile\\\\* OR *\\Windows\\Fonts\\\\*
          OR *\\Windows\\IME\\\\* OR *\\Windows\\addins\\\\*))
  index: logstash-beats-*
  name: Suspicious Program Location with Network Connections
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Program Location with Network Connections
  id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
  status: experimental
  description: Detects programs with network connections running in suspicious files system locations
  references:
      - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
  author: Florian Roth
  date: 2017/03/19
  logsource:
      product: windows
      service: sysmon
      definition: 'Use the following config to generate the necessary Event ID 3 Network Connection events'
  detection:
      selection:
          EventID: 3
          Image: 
              # - '*\ProgramData\\*'  # too many false positives, e.g. with Webex for Windows
              - '*\$Recycle.bin'
              - '*\Users\All Users\\*'
              - '*\Users\Default\\*'
              - '*\Users\Public\\*'
              - '*\Users\Contacts\\*'
              - '*\Users\Searches\\*' 
              - 'C:\Perflogs\\*'
              - '*\config\systemprofile\\*'
              - '*\Windows\Fonts\\*'
              - '*\Windows\IME\\*'
              - '*\Windows\addins\\*'
      condition: selection
  falsepositives:
      - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Suspicious Outbound RDP Connections
  id: ed74fe75-7594-4b4b-ae38-e38e3fd2eb23
  status: experimental
  description: Detects Non-Standard Tools Connecting to TCP port 3389 indicating possible lateral movement
  references:
      - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
  author: Markus Neis - Swisscom
  date: 2019/05/15
  tags:
      - attack.lateral_movement
      - attack.t1210
      - car.2013-07-002
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          DestinationPort: 3389
          Initiated: 'true'
      filter:
          Image:
              - '*\mstsc.exe'
              - '*\RTSApp.exe'
              - '*\RTS2App.exe'
              - '*\RDCMan.exe'
              - '*\ws_TunnelService.exe'
              - '*\RSSensor.exe'
              - '*\RemoteDesktopManagerFree.exe'
              - '*\RemoteDesktopManager.exe'
              - '*\RemoteDesktopManager64.exe'
              - '*\mRemoteNG.exe'
              - '*\mRemote.exe'
              - '*\Terminals.exe'
              - '*\spiceworks-finder.exe'
              - '*\FSDiscovery.exe'
              - '*\FSAssessment.exe'
              - '*\MobaRTE.exe'
              - '*\chrome.exe'
              - '*\thor.exe'
              - '*\thor64.exe'
      condition: selection and not filter 
  falsepositives:
      - Other Remote Desktop RDP tools
  level: high


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:3 AND
          event_data.DestinationPort:3389 AND Initiated:true) AND (NOT (event_data.Image:(*\\mstsc.exe
          OR *\\RTSApp.exe OR *\\RTS2App.exe OR *\\RDCMan.exe OR *\\ws_TunnelService.exe
          OR *\\RSSensor.exe OR *\\RemoteDesktopManagerFree.exe OR *\\RemoteDesktopManager.exe
          OR *\\RemoteDesktopManager64.exe OR *\\mRemoteNG.exe OR *\\mRemote.exe OR
          *\\Terminals.exe OR *\\spiceworks\-finder.exe OR *\\FSDiscovery.exe OR *\\FSAssessment.exe
          OR *\\MobaRTE.exe OR *\\chrome.exe OR *\\thor.exe OR *\\thor64.exe))))
  index: logstash-beats-*
  name: Suspicious Outbound RDP Connections
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Outbound RDP Connections
  id: ed74fe75-7594-4b4b-ae38-e38e3fd2eb23
  status: experimental
  description: Detects Non-Standard Tools Connecting to TCP port 3389 indicating possible lateral movement
  references:
      - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
  author: Markus Neis - Swisscom
  date: 2019/05/15
  tags:
      - attack.lateral_movement
      - attack.t1210
      - car.2013-07-002
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 3
          DestinationPort: 3389
          Initiated: 'true'
      filter:
          Image:
              - '*\mstsc.exe'
              - '*\RTSApp.exe'
              - '*\RTS2App.exe'
              - '*\RDCMan.exe'
              - '*\ws_TunnelService.exe'
              - '*\RSSensor.exe'
              - '*\RemoteDesktopManagerFree.exe'
              - '*\RemoteDesktopManager.exe'
              - '*\RemoteDesktopManager64.exe'
              - '*\mRemoteNG.exe'
              - '*\mRemote.exe'
              - '*\Terminals.exe'
              - '*\spiceworks-finder.exe'
              - '*\FSDiscovery.exe'
              - '*\FSAssessment.exe'
              - '*\MobaRTE.exe'
              - '*\chrome.exe'
              - '*\thor.exe'
              - '*\thor64.exe'
      condition: selection and not filter 
  falsepositives:
      - Other Remote Desktop RDP tools
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  title: Possible Process Hollowing Image Loading
  id: e32ce4f5-46c6-4c47-ba69-5de3c9193cd7
  status: experimental
  description: Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz
  references:
      - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html
  author: Markus Neis
  date: 2018/01/07
  tags:
      - attack.defense_evasion
      - attack.t1073
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 7
          Image:
              - '*\notepad.exe'
          ImageLoaded:
              - '*\samlib.dll'
              - '*\WinSCard.dll'
      condition: selection
  falsepositives:
      - Very likely, needs more tuning
  level: high


customized_type: Issue
value:
  Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:7 AND
          event_data.Image:(*\\notepad.exe) AND event_data.ImageLoaded:(*\\samlib.dll
          OR *\\WinSCard.dll))
  index: logstash-beats-*
  name: Possible Process Hollowing Image Loading
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Possible Process Hollowing Image Loading
  id: e32ce4f5-46c6-4c47-ba69-5de3c9193cd7
  status: experimental
  description: Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz
  references:
      - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html
  author: Markus Neis
  date: 2018/01/07
  tags:
      - attack.defense_evasion
      - attack.t1073
  logsource:
      product: windows
      service: sysmon
  detection:
      selection:
          EventID: 7
          Image:
              - '*\notepad.exe'
          ImageLoaded:
              - '*\samlib.dll'
              - '*\WinSCard.dll'
      condition: selection
  falsepositives:
      - Very likely, needs more tuning
  level: high

  </code></pre>
  }}


# queries

name: Playbook - Community Sigma
column_names:
  ---
  - :status
  - :cf_24
  - :cf_25
  - :cf_6
  - :updated_on

sort_criteria:
  ---
  - - id
  - desc

type: IssueQuery
options:
  ---
  :totalable_names: []
  :draw_relations:
  :draw_progress_line:

filters:
  ---
  cf_24:
    :operator: "="
    :values:
    - Comm-Win-Sysmon
    - Comm-Win-Builtin
    - Comm-Win-Proc
  tracker_id:
    :operator: "="
    :values:
    - '4'


name: Playbook - Internal
column_names:
  ---
  - :status
  - :cf_23
  - :cf_24
  - :cf_25
  - :cf_27
  - :cf_6
  - :updated_on

sort_criteria:
  ---
  - - id
  - desc

type: IssueQuery
options:
  ---
  :totalable_names: []
  :draw_relations:
  :draw_progress_line:

filters:
  ---
  tracker_id:
    :operator: "="
    :values:
    - '4'
  cf_24:
    :operator: "="
    :values:
    - Internal


# documents

title: test
created_on: 2019-08-25 13:41:58.688580
description:
  ``` yaml
  alert:
  - debug
  description: Detects PowerShell called from an executable by the version mismatch
    method
  filter:
  - query:
      query_string:
        query: (event_id:"400" AND event_data.EngineVersion.keyword:(2.* 4.* 5.*) AND
          event_data.HostVersion.keyword:3.*)
  index: logstash-beats-*
  name: PowerShell-called-from-an-Executable-Version-Mismatch_0
  priority: 2
  realert:
    minutes: 0
  type: any
  ```


title: Webhook?
created_on: 2019-08-26 18:43:07.873301
description:
  title: Clear Command History
  status: experimental
  description: Clear command history in linux which is used for defense evasion. 
  references:
      - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1146/T1146.yaml
      - https://attack.mitre.org/techniques/T1146/
  author: Patrick Bareiss
  date: 2019/03/24
  logsource:
      product: linux
  detection:
      keywords:
          - 'rm *bash_history'
          - 'echo "" > *bash_history'
          - 'cat /dev/null > *bash_history' 
          - 'ln -sf /dev/null *bash_history'
          - 'truncate -s0 *bash_history'
          # - 'unset HISTFILE'  # prone to false positives
          - 'export HISTFILESIZE=0'
          - 'history -c'
      condition: keywords
  falsepositives:
      - Unknown
  level: high
  tags:
      - attack.defense_evasion
      - attack.t1146


# custom_fields

type: IssueCustomField
name: Objective
field_format: text
format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  text_formatting: full
  full_width_layout: '1'


type: IssueCustomField
name: Order
field_format: list
format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  url_pattern: ''
  edit_tag_style: ''

possible_values:
  ---
  - '1'
  - '2'
  - '3'
  - '4'
  - '5'
  - '6'
  - '7'
  - '8'
  - '9'
  - '10'
  - '11'
  - '12'
  - '13'
  - '14'
  - '15'


type: IssueCustomField
name: References
field_format: text
format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  text_formatting: full
  full_width_layout: '0'


type: IssueCustomField
name: ATT&CK Technique
field_format: list
possible_values:
  ---
  - T1001
  - T1002
  - T1003
  - T1004
  - T1005
  - T1006
  - T1007
  - T1008
  - T1009
  - T1010
  - T1011
  - T1012
  - T1013
  - T1014
  - T1015
  - T1016
  - T1017
  - T1018
  - T1019
  - T1020
  - T1021
  - T1022
  - T1023
  - T1024
  - T1025
  - T1026
  - T1027
  - T1028
  - T1029
  - T1030
  - T1031
  - T1032
  - T1033
  - T1034
  - T1035
  - T1036
  - T1037
  - T1038
  - T1039
  - T1040
  - T1041
  - T1042
  - T1043
  - T1044
  - T1045
  - T1046
  - T1047
  - T1048
  - T1049
  - T1050
  - T1051
  - T1052
  - T1053
  - T1054
  - T1055
  - T1056
  - T1057
  - T1058
  - T1059
  - T1060
  - T1061
  - T1062
  - T1063
  - T1064
  - T1065
  - T1066
  - T1067
  - T1068
  - T1069
  - T1070
  - T1071
  - T1072
  - T1073
  - T1074
  - T1075
  - T1076
  - T1077
  - T1078
  - T1079
  - T1080
  - T1081
  - T1082
  - T1083
  - T1084
  - T1085
  - T1086
  - T1087
  - T1088
  - T1089
  - T1090
  - T1091
  - T1092
  - T1093
  - T1094
  - T1095
  - T1096
  - T1097
  - T1098
  - T1099
  - T1100
  - T1101
  - T1102
  - T1103
  - T1104
  - T1105
  - T1106
  - T1107
  - T1108
  - T1109
  - T1110
  - T1111
  - T1112
  - T1113
  - T1114
  - T1115
  - T1116
  - T1117
  - T1118
  - T1119
  - T1120
  - T1121
  - T1122
  - T1123
  - T1124
  - T1125
  - T1126
  - T1127
  - T1128
  - T1129
  - T1130
  - T1131
  - T1132
  - T1133
  - T1134
  - T1135
  - T1136
  - T1137
  - T1138
  - T1139
  - T1140
  - T1141
  - T1142
  - T1143
  - T1144
  - T1145
  - T1146
  - T1147
  - T1148
  - T1149
  - T1150
  - T1151
  - T1152
  - T1153
  - T1154
  - T1155
  - T1156
  - T1157
  - T1158
  - T1159
  - T1160
  - T1161
  - T1162
  - T1163
  - T1164
  - T1165
  - T1166
  - T1167
  - T1168
  - T1169
  - T1170
  - T1171
  - T1172
  - T1173
  - T1174
  - T1175
  - T1176
  - T1177
  - T1178
  - T1179
  - T1180
  - T1181
  - T1182
  - T1183
  - T1184
  - T1185
  - T1186
  - T1187
  - T1188
  - T1189
  - T1190
  - T1191
  - T1192
  - T1193
  - T1194
  - T1195
  - T1196
  - T1197
  - T1198
  - T1199
  - T1200
  - T1201
  - T1202
  - T1203
  - T1204
  - T1205
  - T1206
  - T1207
  - T1208
  - T1209
  - T1210
  - T1211
  - T1212
  - T1213
  - T1214
  - T1215
  - T1216
  - T1217
  - T1218
  - T1219
  - T1220
  - T1221
  - T1222
  - T1223
  - T1224
  - T1225
  - T1226
  - T1227
  - T1228
  - T1229
  - T1230
  - T1231
  - T1232
  - T1233
  - T1234
  - T1235
  - T1236
  - T1237
  - T1238
  - T1239
  - T1240
  - T1241
  - T1242
  - T1243
  - T1244
  - T1245
  - T1246
  - T1247
  - T1248
  - T1249
  - T1250
  - T1251
  - T1252
  - T1253
  - T1254
  - T1255
  - T1256
  - T1257
  - T1258
  - T1259
  - T1260
  - T1261
  - T1262
  - T1263
  - T1264
  - T1265
  - T1266
  - T1267
  - T1268
  - T1269
  - T1270
  - T1271
  - T1272
  - T1273
  - T1274
  - T1275
  - T1276
  - T1277
  - T1278
  - T1279
  - T1280
  - T1281
  - T1282
  - T1283
  - T1284
  - T1285
  - T1286
  - T1287
  - T1288
  - T1289
  - T1290
  - T1291
  - T1292
  - T1293
  - T1294
  - T1295
  - T1296
  - T1297
  - T1298
  - T1299
  - T1300
  - T1301
  - T1302
  - T1303
  - T1304
  - T1305
  - T1306
  - T1307
  - T1308
  - T1309
  - T1310
  - T1311
  - T1312
  - T1313
  - T1314
  - T1315
  - T1316
  - T1317
  - T1318
  - T1319
  - T1320
  - T1321
  - T1322
  - T1323
  - T1324
  - T1325
  - T1326
  - T1327
  - T1328
  - T1329
  - T1330
  - T1331
  - T1332
  - T1333
  - T1334
  - T1335
  - T1336
  - T1337
  - T1338
  - T1339
  - T1340
  - T1341
  - T1342
  - T1343
  - T1344
  - T1345
  - T1346
  - T1347
  - T1348
  - T1349
  - T1350
  - T1351
  - T1352
  - T1353
  - T1354
  - T1355
  - T1356
  - T1357
  - T1358
  - T1359
  - T1360
  - T1361
  - T1362
  - T1363
  - T1364
  - T1365
  - T1366
  - T1367
  - T1368
  - T1369
  - T1370
  - T1371
  - T1372
  - T1373
  - T1374
  - T1375
  - T1376
  - T1377
  - T1378
  - T1379
  - T1380
  - T1381
  - T1382
  - T1383
  - T1384
  - T1385
  - T1386
  - T1387
  - T1388
  - T1389
  - T1390
  - T1391
  - T1392
  - T1393
  - T1394
  - T1395
  - T1396
  - T1397
  - T1398
  - T1399
  - T1400
  - T1401
  - T1402
  - T1403
  - T1404
  - T1405
  - T1406
  - T1407
  - T1408
  - T1409
  - T1410
  - T1411
  - T1412
  - T1413
  - T1414
  - T1415
  - T1416
  - T1417
  - T1418
  - T1419
  - T1420
  - T1421
  - T1422
  - T1423
  - T1424
  - T1425
  - T1426
  - T1427
  - T1428
  - T1429
  - T1430
  - T1431
  - T1432
  - T1433
  - T1434
  - T1435
  - T1436
  - T1437
  - T1438
  - T1439
  - T1440
  - T1441
  - T1442
  - T1443
  - T1444
  - T1445
  - T1446
  - T1447
  - T1448
  - T1449
  - T1450
  - T1451
  - T1452
  - T1453
  - T1454
  - T1455
  - T1456
  - T1457
  - T1458
  - T1459
  - T1460
  - T1461
  - T1462
  - T1463
  - T1464
  - T1465
  - T1466
  - T1467
  - T1468
  - T1469
  - T1470
  - T1471
  - T1472
  - T1473
  - T1474
  - T1475
  - T1476
  - T1477
  - T1478
  - T1479
  - T1480
  - T1481
  - T1482
  - T1483
  - T1484
  - T1485
  - T1486
  - T1487
  - T1488
  - T1489
  - T1490
  - T1491
  - T1492
  - T1493
  - T1494
  - T1495
  - T1496
  - T1497
  - T1498
  - T1499
  - T1500
  - T1501
  - T1502
  - T1503
  - T1504
  - T1505
  - T1506
  - T1507
  - T1508
  - T1509
  - T1510
  - T1511
  - T1512
  - T1513
  - T1514
  - T1515
  - T1516
  - T1517
  - T1518
  - T1519
  - T1520
  - T1521
  - T1522
  - T1523
  - T1524
  - T1525
  - T1526
  - T1527
  - T1528
  - T1529
  - T1530
  - T1531
  - T1532
  - T1533
  - T1534
  - T1535
  - T1536
  - T1537
  - T1538
  - T1539
  - T1540
  - T1541
  - T1542
  - T1543
  - T1544
  - T1545
  - T1546
  - T1547
  - T1548
  - T1549
  - T1550
  - T1551
  - T1552
  - T1553

format_store:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  url_pattern: https://attack.mitre.org/techniques/%value%
  edit_tag_style: ''


# imports

type: IssueImport
filename: c32da363ebee1050517ca61125f96878
created_at: 2019-06-28 20:39:19.990976
updated_at: 2019-06-28 20:40:07.491869
settings:
  ---
  separator: ","
  wrapper: "\""
  encoding: ISO-8859-1
  date_format: "%m/%d/%Y"
  mapping: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    project_id: '1'
    tracker: '2'
    status: '4'
    subject: '6'
    description: ''
    priority: ''
    category: ''
    assigned_to: ''
    fixed_version: ''
    cf_1: ''
    cf_6: ''
    cf_2: ''
    cf_7: ''
    cf_3: ''
    cf_5: ''
    cf_4: ''
    cf_8: ''
    cf_9: ''
    cf_10: ''
    cf_11: ''
    cf_12: ''
    cf_14: ''
    is_private: ''
    parent_issue_id: ''
    start_date: ''
    due_date: ''
    estimated_hours: ''
    done_ratio: ''


type: IssueImport
filename: 96833c42a8e490907fac465dc55d80b6
created_at: 2019-06-28 20:40:36.340614
updated_at: 2019-06-28 20:41:01.781417
settings:
  ---
  separator: ","
  wrapper: "\""
  encoding: ISO-8859-1
  date_format: "%m/%d/%Y"
  mapping: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    project_id: '1'
    tracker: '2'
    status: ''
    subject: '6'
    description: ''
    priority: ''
    category: ''
    assigned_to: ''
    fixed_version: ''
    cf_1: '15'
    cf_6: '16'
    cf_2: ''
    cf_7: ''
    cf_3: ''
    cf_5: ''
    cf_4: ''
    cf_8: ''
    cf_9: ''
    cf_10: ''
    cf_11: ''
    cf_12: ''
    cf_14: ''
    is_private: ''
    parent_issue_id: ''
    start_date: ''
    due_date: ''
    estimated_hours: ''
    done_ratio: ''


# roles

name: Non member
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :view_issues
  - :add_issues
  - :add_issue_notes
  - :save_queries
  - :view_gantt
  - :view_calendar
  - :view_time_entries
  - :view_news
  - :comment_news
  - :view_documents
  - :view_wiki_pages
  - :view_wiki_edits
  - :view_messages
  - :add_messages
  - :view_files
  - :browse_repository
  - :view_changesets


name: Anonymous
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :view_messages
  - :view_calendar
  - :view_documents
  - :view_files
  - :view_gantt
  - :view_news
  - :view_changesets
  - :browse_repository
  - :view_time_entries
  - :view_wiki_edits

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '0'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '0'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: SuperAdmin
issues_visibility: all
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :add_project
  - :edit_project
  - :close_project
  - :select_project_modules
  - :manage_members
  - :manage_versions
  - :add_subprojects
  - :manage_public_queries
  - :save_queries
  - :manage_hook
  - :view_messages
  - :add_messages
  - :edit_messages
  - :edit_own_messages
  - :delete_messages
  - :delete_own_messages
  - :manage_boards
  - :view_calendar
  - :view_documents
  - :add_documents
  - :edit_documents
  - :delete_documents
  - :view_files
  - :manage_files
  - :view_gantt
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :manage_issue_relations
  - :manage_subtasks
  - :set_issues_private
  - :set_own_issues_private
  - :add_issue_notes
  - :edit_issue_notes
  - :edit_own_issue_notes
  - :view_private_notes
  - :set_notes_private
  - :delete_issues
  - :view_issue_watchers
  - :add_issue_watchers
  - :delete_issue_watchers
  - :import_issues
  - :manage_categories
  - :view_news
  - :manage_news
  - :comment_news
  - :view_changesets
  - :browse_repository
  - :commit_access
  - :manage_related_issues
  - :manage_repository
  - :view_time_entries
  - :log_time
  - :edit_time_entries
  - :edit_own_time_entries
  - :manage_project_activities
  - :view_wiki_pages
  - :view_wiki_edits
  - :export_wiki_pages
  - :edit_wiki_pages
  - :rename_wiki_pages
  - :delete_wiki_pages
  - :delete_wiki_pages_attachments
  - :protect_wiki_pages
  - :manage_wiki

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: Security-Analyst
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :save_queries
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :add_issue_notes
  - :view_private_notes

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '0'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    add_issues:
    - '6'
    view_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: Admin
issues_visibility: all
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :add_project
  - :edit_project
  - :close_project
  - :select_project_modules
  - :manage_members
  - :manage_versions
  - :add_subprojects
  - :manage_public_queries
  - :save_queries
  - :view_messages
  - :add_messages
  - :edit_messages
  - :edit_own_messages
  - :delete_messages
  - :delete_own_messages
  - :manage_boards
  - :view_calendar
  - :view_documents
  - :add_documents
  - :edit_documents
  - :delete_documents
  - :view_files
  - :manage_files
  - :view_gantt
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :manage_issue_relations
  - :set_issues_private
  - :set_own_issues_private
  - :add_issue_notes
  - :edit_issue_notes
  - :edit_own_issue_notes
  - :view_private_notes
  - :set_notes_private
  - :delete_issues
  - :view_issue_watchers
  - :add_issue_watchers
  - :delete_issue_watchers
  - :import_issues
  - :manage_categories
  - :view_news
  - :manage_news
  - :comment_news
  - :view_changesets
  - :browse_repository
  - :commit_access
  - :manage_related_issues
  - :manage_repository
  - :view_time_entries
  - :log_time
  - :edit_time_entries
  - :edit_own_time_entries
  - :manage_project_activities
  - :view_wiki_pages
  - :view_wiki_edits
  - :export_wiki_pages
  - :edit_wiki_pages
  - :rename_wiki_pages
  - :delete_wiki_pages
  - :delete_wiki_pages_attachments
  - :protect_wiki_pages
  - :manage_wiki

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


name: Automation
issues_visibility: default
users_visibility: all
time_entries_visibility: all
permissions:
  ---
  - :save_queries
  - :view_issues
  - :add_issues
  - :edit_issues
  - :copy_issues
  - :add_issue_notes
  - :edit_issue_notes
  - :edit_own_issue_notes
  - :view_private_notes
  - :import_issues
  - :manage_categories

settings:
  --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess
  permissions_all_trackers: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: '1'
    add_issues: '1'
    edit_issues: '1'
    add_issue_notes: '1'
    delete_issues: '1'
  permissions_tracker_ids: !ruby/hash:ActiveSupport::HashWithIndifferentAccess
    view_issues: []
    add_issues: []
    edit_issues: []
    add_issue_notes: []
    delete_issues: []


# user_preferences

others:
  ---
  :no_self_notified: '1'
  :my_page_layout:
    left: []
    right: []
  :my_page_settings: {}
  :gantt_zoom: 2
  :gantt_months: 6
  :comments_sorting: asc
  :warn_on_leaving_unsaved: '1'
  :textarea_font: ''


others:
  ---
  :no_self_notified: '1'
  :comments_sorting: asc
  :warn_on_leaving_unsaved: '1'
  :textarea_font: ''
  :my_page_layout:
    left:
    - issuesassignedtome
    right:
    - issuesreportedbyme
  :my_page_settings: {}


