migrate from deprecated filter fields, expand rundll32.exe proxy execution command line matches

Author: rabbitstack

rules/credential_access_credentials_from_password_stores.yml

@@ -127,9 +127,9 @@
       condition: >
         spawn_process
             and
-        ps.sibling.name ~= 'VaultCmd.exe'
+        ps.child.name ~= 'VaultCmd.exe'
             and
-        ps.sibling.args
+        ps.child.args
             in
           (
             '"/listcreds:Windows Credentials"',
@@ -148,9 +148,9 @@
       condition: >
         spawn_process
             and
-        ps.sibling.name ~= 'rundll32.exe'
+        ps.child.name ~= 'rundll32.exe'
             and
-        (ps.sibling.args iin ('keymgr.dll') and ps.sibling.args iin ('KRShowKeyMgr'))
+        (ps.child.args iin ('keymgr.dll') and ps.child.args iin ('KRShowKeyMgr'))
       action: >
         {{
             emit

rules/credential_access_os_credential_dumping.yml

@@ -54,7 +54,8 @@
             not
         ps.exe imatches
             (
-                '?:\\Windows\\System32\\lsass.exe'
+                '?:\\Windows\\System32\\lsass.exe',
+                '?:\\Windows\\System32\\Taskmgr.exe'
             )
       action: >
         {{
@@ -92,7 +93,7 @@
               and
            ps.access.mask.names in ('ALL_ACCESS', 'CREATE_PROCESS')
               and
-           ps.sibling.name ~= 'lsass.exe'
+           kevt.arg[exe] imatches '?:\\Windows\\System32\\lsass.exe'
               and
               not
            ps.exe imatches
@@ -144,19 +145,18 @@
       condition: >
         sequence
         maxspan 2m
-        by ps.pid
           |spawn_process
               and
-            ps.name in
+            ps.child.name in
               (
                 'WerFault.exe',
                 'WerFaultSecure.exe'
               )
-          |
+          | by ps.child.uuid
           |write_minidump_file
               and
            file.name icontains 'lsass'
-          |
+          | by ps.uuid
       action: >
         {{
             emit

rules/defense_evasion_system_binary_proxy_execution.yml

@@ -17,20 +17,26 @@
     subtechnique.ref: https://attack.mitre.org/techniques/T1218/011/
   rules:
     - name: System Binary Proxy Execution via Rundll32
+      description: |
+        Detects the execution of rundll32.exe process with suspicious command line
+        followed by the creation of a child process which would probably unleash
+        nefarious actions in the system.
       condition: >
         sequence
         maxspan 1m
           |spawn_process
               and
-           ps.sibling.name ~= 'rundll32.exe'
+           ps.child.name ~= 'rundll32.exe'
               and
-           ps.sibling.comm imatches
+           ps.child.cmdline imatches
               (
                 '*javascript:*',
+                '*vbscript:*',
                 '*shell32.dll*ShellExec_RunDLL*',
-                '*-sta*'
+                '*-sta*',
+                '*RunHTMLApplication*',
               )
-          | by ps.sibling.pid
+          | by ps.child.pid
           |spawn_process| by ps.pid
       action: >
         {{
@@ -55,21 +61,21 @@
   rules:
     - name: Regsvr32 scriptlet execution
       description: |
-        Identifies the exection of a scriptlet file by regsvr32.exe process. Regsvr32
+        Identifies the execution of a scriptlet file by regsvr32.exe process. Regsvr32
         is usually abused by adversaries to execute malicious payloads without triggering
         AV product alerts.
       condition: >
         spawn_process
             and
-        ps.sibling.name ~= 'regsvr32.exe'
+        ps.child.name ~= 'regsvr32.exe'
             and
         (
-          ps.sibling.comm imatches
+          ps.child.cmdline imatches
           (
             '*scrobj*'
           )
             and
-          ps.sibling.comm imatches
+          ps.child.cmdline imatches
           (
             '*/i:*',
             '*-i:*',

rules/initial_access_phishing.yml

@@ -28,7 +28,7 @@
           |spawn_process
               and
            ps.name iin msoffice_binaries
-          | by ps.sibling.exe
+          | by ps.child.exe
       action: >
         {{
             emit . "File execution via Microsoft Office process" ""