Skip to content

Commit 2851ef5

Browse files
tsalenasbench
tsale
and
nasbench
authored
Merge PR #4961 from @tsale - Add multiples rules and updates
fix: Potential Privilege Escalation via Local Kerberos Relay over LDAP - Add new exclusion fix: Sdiagnhost Calling Suspicious Child Process - Add new filters new: Antivirus Filter Driver Disallowed On Dev Drive - Registry new: ChromeLoader Malware Execution new: Emotet Loader Execution Via .LNK File new: Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC new: FakeUpdates/SocGholish Activity new: File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell new: HackTool - SharpWSUS/WSUSpendu Execution new: HackTool - SOAPHound Execution new: Hiding User Account Via SpecialAccounts Registry Key - CommandLine new: Injected Browser Process Spawning Rundll32 - GuLoader Activity new: Kerberoasting Activity - Initial Query new: Manual Execution of Script Inside of a Compressed File new: Obfuscated PowerShell OneLiner Execution new: OneNote.EXE Execution of Malicious Embedded Scripts new: Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon new: Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution new: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 new: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 new: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 new: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4 new: Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE new: Python Function Execution Security Warning Disabled In Excel new: Python Function Execution Security Warning Disabled In Excel - Registry new: Raspberry Robin Initial Execution From External Drive new: Raspberry Robin Subsequent Execution of Commands new: Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions new: Remote Access Tool - Ammy Admin Agent Execution new: Remote Access Tool - Cmd.EXE Execution via AnyViewer new: Serpent Backdoor Payload Execution Via Scheduled Task new: Uncommon Connection to Active Directory Web Services new: Ursnif Redirection Of Discovery Commands update: Potential CVE-2022-29072 Exploitation Attempt - Add additional shells and flags --------- Co-authored-by: nasbench <[email protected]>
1 parent 4cd51a3 commit 2851ef5

File tree

40 files changed

+4769
-31
lines changed

40 files changed

+4769
-31
lines changed

Diff for: ‎rules-emerging-threats/2020/Exploits/CVE-2020-1472/proc_creation_win_exploit_cve_2020_1472_zero_poc.yml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
title: Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC
2+
id: dcc6a01e-9471-44a0-a699-71ea96f8ed8b
3+
status: experimental
4+
description: Detects the execution of the commonly used ZeroLogon PoC executable.
5+
references:
6+
- https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/
7+
- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
8+
author: '@Kostastsale, @TheDFIRReport'
9+
date: 2022-02-12
10+
tags:
11+
- attack.execution
12+
- attack.lateral-movement
13+
- attack.t1210
14+
- cve.2020-1472
15+
- detection.emerging-threats
16+
logsource:
17+
product: windows
18+
category: process_creation
19+
detection:
20+
selection_main:
21+
ParentImage|endswith: '\cmd.exe'
22+
Image|endswith:
23+
- '\cool.exe'
24+
- '\zero.exe'
25+
CommandLine|contains|all:
26+
- 'Administrator'
27+
- '-c'
28+
selection_payloads_1:
29+
CommandLine|contains|all:
30+
- 'taskkill'
31+
- '/f'
32+
- '/im'
33+
selection_payloads_2:
34+
CommandLine|contains: 'powershell'
35+
condition: selection_main and 1 of selection_payloads_*
36+
falsepositives:
37+
- Unknown
38+
level: high

Diff for: ‎rules-emerging-threats/2021/Exploits/CVE-2021-44228/proc_creation_win_exploit_cve_2021_44228_vmware_horizon_log4j.yml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
title: Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon
2+
id: 3eb91f0a-0060-424a-a676-59f5fdd75610
3+
status: experimental
4+
description: |
5+
Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.
6+
references:
7+
- https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
8+
- https://twitter.com/TheDFIRReport/status/1482078434327244805
9+
- https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
10+
author: '@kostastsale'
11+
date: 2022-01-14
12+
tags:
13+
- attack.initial-access
14+
- attack.t1190
15+
- cve.2021-44228
16+
- detection.emerging-threats
17+
logsource:
18+
category: process_creation
19+
product: windows
20+
detection:
21+
selection:
22+
ParentImage|endswith: '\ws_TomcatService.exe'
23+
filter_main_shells:
24+
Image|endswith:
25+
- '\cmd.exe'
26+
- '\powershell.exe'
27+
condition: selection and not 1 of filter_main_*
28+
falsepositives:
29+
- Unlikely
30+
level: high

Diff for: ‎rules-emerging-threats/2022/Exploits/CVE-2022-22954/proc_creation_win_exploit_cve_2022_22954_vmware_workspace_one_rce.yml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
title: Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution
2+
id: 5660d8db-6e25-411f-b92f-094420168a5d
3+
status: experimental
4+
description: |
5+
Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager.
6+
As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.
7+
references:
8+
- https://blog.morphisec.com/vmware-identity-manager-attack-backdoor
9+
- https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC
10+
author: '@kostastsale'
11+
date: 2022-04-25
12+
tags:
13+
- attack.execution
14+
- attack.initial-access
15+
- attack.t1059.006
16+
- attack.t1190
17+
- cve.2022-22954
18+
- detection.emerging-threats
19+
logsource:
20+
category: process_creation
21+
product: windows
22+
detection:
23+
selection_parent:
24+
ParentImage|endswith: '\prunsrv.exe'
25+
selection_payload_pwsh:
26+
Image|endswith: '\powershell.exe'
27+
selection_payload_cmd:
28+
Image|endswith: '\cmd.exe'
29+
CommandLine|contains: '/c powershell'
30+
condition: selection_parent and 1 of selection_payload_*
31+
falsepositives:
32+
- Some false positives are possible as part of a custom script implementation from admins executed with cmd.exe as the child process.
33+
level: medium

Diff for: ‎rules-emerging-threats/2022/Exploits/CVE-2022-29072/proc_creation_win_exploit_cve_2022_29072_7zip.yml

+22-12
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ description: |
88
references:
99
- https://github.com/kagancapar/CVE-2022-29072
1010
- https://twitter.com/kagancapar/status/1515219358234161153
11-
author: frack113
11+
author: frack113, @kostastsale
1212
date: 2022-04-17
13-
modified: 2023-02-07
13+
modified: 2024-08-15
1414
tags:
1515
- attack.execution
1616
- cve.2022-29072
@@ -19,19 +19,29 @@ logsource:
1919
product: windows
2020
category: process_creation
2121
detection:
22-
selection_img:
23-
- Image|endswith: '\cmd.exe'
24-
- OriginalFileName: 'Cmd.Exe'
2522
selection_parent:
2623
ParentImage|endswith: '\7zFM.exe'
27-
filter_bat:
28-
CommandLine|contains:
29-
- ' /c '
30-
- ' /k '
31-
- ' /r '
32-
filter_null:
24+
selection_img:
25+
- Image|endswith:
26+
- '\cmd.exe'
27+
- '\powershell.exe'
28+
- '\pwsh.exe'
29+
- OriginalFileName:
30+
- 'Cmd.Exe'
31+
- 'PowerShell.EXE'
32+
- 'pwsh.dll'
33+
filter_main_extensions_and_flags:
34+
- CommandLine|contains:
35+
- ' /c '
36+
- ' /k '
37+
- ' /r '
38+
- CommandLine|endswith:
39+
- '.bat'
40+
- '.cmd'
41+
- '.ps1'
42+
filter_main_null:
3343
CommandLine: null
34-
condition: all of selection_* and not 1 of filter_*
44+
condition: all of selection_* and not 1 of filter_main_*
3545
falsepositives:
3646
- Unknown
3747
level: high

Diff for: ‎rules-emerging-threats/2022/Malware/ChromeLoader/proc_creation_win_malware_chrome_loader_execution.yml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
title: ChromeLoader Malware Execution
2+
id: 0a74c5a9-1b71-4475-9af2-7829d320d5c2
3+
status: experimental
4+
description: Detects execution of ChromeLoader malware via a registered scheduled task
5+
references:
6+
- https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER
7+
- https://twitter.com/th3_protoCOL/status/1480621526764322817
8+
- https://twitter.com/Kostastsale/status/1480716528421011458
9+
- https://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd
10+
author: '@kostastsale'
11+
date: 2022-01-10
12+
tags:
13+
- attack.execution
14+
- attack.persistence
15+
- attack.t1053.005
16+
- attack.t1059.001
17+
- attack.t1176
18+
- detection.emerging-threats
19+
logsource:
20+
category: process_creation
21+
product: windows
22+
detection:
23+
selection:
24+
ParentImage|endswith: '\powershell.exe'
25+
ParentCommandLine|contains: '-ExecutionPolicy Bypass -WindowStyle Hidden -E JAB'
26+
CommandLine|contains: '--load-extension="*\Appdata\local\chrome"'
27+
Image|endswith: '\chrome.exe'
28+
condition: selection
29+
falsepositives:
30+
- Unlikely
31+
level: high

Diff for: ‎rules-emerging-threats/2022/Malware/Emotet/proc_creation_win_malware_emotet_loader_execution.yml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
title: Emotet Loader Execution Via .LNK File
2+
id: 1f32d820-1d5c-43fe-8fe2-feef0c952eb7
3+
status: experimental
4+
description: |
5+
Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022.
6+
The ".lnk" file was delivered via phishing campaign.
7+
references:
8+
- https://web.archive.org/web/20220422215221/https://twitter.com/malware_traffic/status/1517622327000846338
9+
- https://twitter.com/Cryptolaemus1/status/1517634855940632576
10+
- https://tria.ge/220422-1pw1pscfdl/
11+
- https://tria.ge/220422-1nnmyagdf2/
12+
author: '@kostastsale'
13+
date: 2022-04-22
14+
modified: 2024-08-15
15+
tags:
16+
- attack.execution
17+
- attack.t1059.006
18+
- detection.emerging-threats
19+
logsource:
20+
category: process_creation
21+
product: windows
22+
detection:
23+
selection:
24+
ParentImage|endswith:
25+
- '\cmd.exe'
26+
- '\explorer.exe'
27+
- '\powershell.exe'
28+
Image|endswith:
29+
- '\cmd.exe'
30+
- '\powershell.exe'
31+
CommandLine|contains|all:
32+
- 'findstr'
33+
- '.vbs'
34+
- '.lnk'
35+
condition: selection
36+
falsepositives:
37+
- Unlikely
38+
level: high

Diff for: ‎rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_execution.yml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
title: Raspberry Robin Subsequent Execution of Commands
2+
id: d52d2e87-eb03-4fac-961d-eb616da79788
3+
related:
4+
- id: 2c6bea3a-ef58-4f2e-a775-4928f6b7c58a
5+
type: similar
6+
status: experimental
7+
description: Detects raspberry robin subsequent execution of commands.
8+
references:
9+
- https://redcanary.com/blog/raspberry-robin/
10+
author: '@kostastsale'
11+
date: 2022-05-06
12+
tags:
13+
- attack.execution
14+
- attack.t1059.001
15+
- detection.emerging-threats
16+
logsource:
17+
category: process_creation
18+
product: windows
19+
detection:
20+
selection:
21+
ParentImage|endswith: '\fodhelper.exe'
22+
Image|endswith:
23+
- '\rundll32.exe'
24+
- '\regsvr32.exe'
25+
CommandLine|contains|all:
26+
- 'odbcconf.exe'
27+
- 'regsvr'
28+
- 'shellexec_rundll'
29+
CommandLine|contains:
30+
- 'installdriver'
31+
- 'setfiledsndir'
32+
- 'vkipdse'
33+
CommandLine|endswith|windash:
34+
- '/a'
35+
- '/f'
36+
- '/s'
37+
condition: selection
38+
falsepositives:
39+
- Unlikely
40+
level: high

Diff for: ‎rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_external_drive_exec.yml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
title: Raspberry Robin Initial Execution From External Drive
2+
id: 2c6bea3a-ef58-4f2e-a775-4928f6b7c58a
3+
related:
4+
- id: d52d2e87-eb03-4fac-961d-eb616da79788
5+
type: similar
6+
status: experimental
7+
description: Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".
8+
references:
9+
- https://redcanary.com/blog/raspberry-robin/
10+
author: '@kostastsale'
11+
date: 2022-05-06
12+
tags:
13+
- attack.execution
14+
- attack.t1059.001
15+
- detection.emerging-threats
16+
logsource:
17+
category: process_creation
18+
product: windows
19+
detection:
20+
selection_parent:
21+
ParentImage|endswith: '\cmd.exe'
22+
ParentCommandLine|contains: '/r'
23+
ParentCommandLine|endswith:
24+
- '.bin'
25+
- '.ico'
26+
- '.lnk'
27+
- '.lo'
28+
- '.sv'
29+
- '.usb'
30+
selection_child_img:
31+
Image|endswith: '\msiexec.exe'
32+
CommandLine|contains|windash: '/q'
33+
selection_child_http:
34+
CommandLine|contains:
35+
- 'http:'
36+
- 'https:'
37+
condition: all of selection_*
38+
falsepositives:
39+
- Unlikely
40+
level: high

Diff for: ‎rules-emerging-threats/2022/Malware/Serpent-Backdoor/proc_creation_win_malware_serpent_backdoor_payload_execution.yml

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
title: Serpent Backdoor Payload Execution Via Scheduled Task
2+
id: d5eb7432-fda4-4bba-a37f-ffa74d9ed639
3+
status: experimental
4+
description: |
5+
Detects post exploitation execution technique of the Serpent backdoor.
6+
According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
7+
It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.
8+
references:
9+
- https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
10+
author: '@kostastsale'
11+
date: 2022-03-21
12+
tags:
13+
- attack.execution
14+
- attack.persistence
15+
- attack.t1053.005
16+
- attack.t1059.006
17+
- detection.emerging-threats
18+
logsource:
19+
category: process_creation
20+
product: windows
21+
detection:
22+
selection:
23+
Image|endswith:
24+
- '\cmd.exe'
25+
- '\powershell.exe'
26+
CommandLine|contains|all:
27+
- '[System/EventID='
28+
- '/create'
29+
- '/delete'
30+
- '/ec'
31+
- '/so'
32+
- '/tn run'
33+
condition: selection
34+
falsepositives:
35+
- Unlikely
36+
level: high

Diff for: ‎rules-emerging-threats/2022/Malware/SocGholish/proc_creation_win_malware_socgholish_fakeupdates_activity.yml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
title: FakeUpdates/SocGholish Activity
2+
id: 97805087-93ab-4203-b5cb-287cda6aecaa
3+
status: experimental
4+
description: Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.
5+
references:
6+
- https://twitter.com/th3_protoCOL/status/1536788652889497600
7+
- https://twitter.com/1ZRR4H/status/1537501582727778304
8+
author: '@kostastsale'
9+
date: 2022-06-16
10+
modified: 2024-08-23
11+
tags:
12+
- attack.execution
13+
- attack.t1059.001
14+
- detection.emerging-threats
15+
logsource:
16+
category: process_creation
17+
product: windows
18+
detection:
19+
selection:
20+
ParentImage|endswith: '\wscript.exe'
21+
ParentCommandLine|contains|all:
22+
- '\AppData\Local\Temp'
23+
- '.zip'
24+
- 'update'
25+
- '.js'
26+
ParentCommandLine|contains:
27+
- 'Chrome'
28+
- 'Edge'
29+
- 'Firefox'
30+
- 'Opera'
31+
- 'Brave' # Not seen in campaigns
32+
- 'Vivaldi' # Not seen in campaigns
33+
Image|endswith:
34+
- '\cmd.exe'
35+
- '\powershell.exe'
36+
- '\pwsh.exe'
37+
condition: selection
38+
falsepositives:
39+
- Unlikely
40+
level: high

0 commit comments

Comments
 (0)