Skip to content

Commit df817fb

Browse files
rabbitstackrabbitstack
committed
fix(rules): Eliminate false positives and apply hardening
1 parent f2bb1a9 commit df817fb

File tree

25 files changed

+293
-142
lines changed

25 files changed

+293
-142
lines changed

‎rules/credentail_access_file_access_to_sam_database.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: File access to SAM database
22
id: e3dace20-4962-4381-884e-40dcdde66626
3-
version: 1.0.5
3+
version: 1.0.6
44
description: |
55
Identifies access to the Security Account Manager on-disk database.
66
labels:
@@ -27,7 +27,15 @@ condition: >
2727
'?:\\Program Files\\*',
2828
'?:\\Program Files (x86)\\*',
2929
'?:\\Windows\\System32\\lsass.exe',
30-
'?:\\Windows\\System32\\srtasks.exe'
30+
'?:\\Windows\\System32\\srtasks.exe',
31+
'?:\\Windows\\System32\\svchost.exe',
32+
'?:\\Windows\\System32\\Dism.exe',
33+
'?:\\Windows\\System32\\vmwp.exe',
34+
'?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe',
35+
'?:\\Windows\\System32\\wuauclt.exe',
36+
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
37+
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MpCopyAccelerator.exe',
38+
'?:\\Windows\\System32\\MRT.exe'
3139
)
3240
3341
min-engine-version: 3.0.0

‎rules/credential_access_credential_manager_access_via_known_tools.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Credential Manager access via known tools
22
id: 5b4130f8-bc73-4890-b5f6-b03cddc75a52
3-
version: 1.0.0
3+
version: 1.0.1
44
description: |
55
Detects access to the Windows Credential Manager using built-in
66
utilities such as vaultcmd.exe, cmdkey.exe, rundll32.exe, and
@@ -19,10 +19,10 @@ labels:
1919

2020
condition: >
2121
spawn_process and
22-
((ps.name ~= 'VaultCmd.exe' or ps.pe.file.name ~= 'vaultcmd.exe') and ps.cmdline imatches '*/list*') or
22+
(((ps.name ~= 'VaultCmd.exe' or ps.pe.file.name ~= 'vaultcmd.exe') and ps.cmdline imatches '*/list*') or
2323
((ps.name ~= 'rundll32.exe' or ps.pe.file.name ~= 'rundll32.exe') and ps.cmdline imatches '*keymgr.dll*KRShowKeyMgr*') or
2424
((ps.name ~= 'cmdkey.exe' or ps.pe.file.name ~= 'cmdkey.exe') and ps.cmdline imatches '*/list*') or
25-
((ps.name ~= 'control.exe' or ps.pe.file.name ~= 'control.exe') and ps.cmdline imatches '*keymgr.dll*')
25+
((ps.name ~= 'control.exe' or ps.pe.file.name ~= 'control.exe') and ps.cmdline imatches '*keymgr.dll*'))
2626
2727
severity: medium
2828

‎rules/credential_access_lsass_access_from_unsigned_executable.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: LSASS access from unsigned executable
22
id: 348bf896-2201-444f-b1c9-e957a1f063bf
3-
version: 1.0.3
3+
version: 1.0.4
44
description: |
55
Detects attempts by an unsigned process to access the Local Security Authority Subsystem Service (LSASS).
66
Adversaries may try to dump credential information stored in the process memory of LSASS.
@@ -21,7 +21,9 @@ condition: >
2121
sequence
2222
maxspan 7m
2323
by ps.uuid
24-
|load_unsigned_executable|
24+
|load_unsigned_executable and
25+
ps.exe not imatches '?:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe'
26+
|
2527
|((open_process) or (open_thread)) and evt.arg[exe] imatches '?:\\Windows\\System32\\lsass.exe'|
2628
action:
2729
- name: kill

‎rules/credential_access_potential_sam_hive_dumping.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Potential SAM hive dumping
22
id: 2f326557-0291-4eb1-a87a-7a17b7d941cb
3-
version: 1.0.7
3+
version: 1.0.8
44
description:
55
Identifies access to the Security Account Manager registry hives.
66
labels:
@@ -27,7 +27,8 @@ condition: >
2727
'?:\\Program Files (x86)\\*.exe',
2828
'?:\\Windows\\System32\\svchost.exe'
2929
) or
30-
(ps.cmdline imatches '"?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior')
30+
(ps.cmdline imatches '"?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior') or
31+
(ps.exe imatches '?:\\WINDOWS\\system32\\wevtutil.exe' and ps.parent.exe imatches '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe')
3132
)
3233
|
3334
|open_registry and
@@ -36,6 +37,7 @@ condition: >
3637
(
3738
'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users',
3839
'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names',
40+
'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\WDAGUtilityAccount\\ChannelReferences',
3941
'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account',
4042
'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Account\\Aliases\\*'
4143
) and

‎rules/credential_access_suspicious_access_to_windows_vault_files.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Suspicious access to Windows Vault files
22
id: 44400221-f98d-424a-9388-497c75b18924
3-
version: 1.0.4
3+
version: 1.0.5
44
description: |
55
Identifies attempts from adversaries to acquire credentials from Vault files.
66
labels:
@@ -24,10 +24,15 @@ condition: >
2424
file.extension in vault_extensions and
2525
ps.exe not imatches
2626
(
27-
'?:\\Program Files\\*',
28-
'?:\\Program Files(x86)\\*',
27+
'?:\\Program Files\\*.exe',
28+
'?:\\Program Files(x86)\\*.exe',
2929
'?:\\Windows\\System32\\lsass.exe',
30-
'?:\\Windows\\System32\\svchost.exe'
30+
'?:\\Windows\\System32\\svchost.exe',
31+
'?:\\Windows\\System32\\SearchProtocolHost.exe',
32+
'?:\\Windows\\Explorer.exe',
33+
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
34+
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MpCopyAccelerator.exe',
35+
'?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe'
3136
)
3237
3338
min-engine-version: 3.0.0

‎rules/credential_access_suspicious_vault_client_dll_load.yml‎

Lines changed: 35 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Suspicious Vault client DLL load
22
id: 64af2e2e-2309-4079-9c0f-985f1dd930f5
3-
version: 1.0.5
3+
version: 1.0.6
44
description: |
55
Identifies loading of the Vault client DLL by an unusual process. Adversaries can abuse the functions provided
66
by the Credential Vault Client Library to enumerate or harvest saved credentials.
@@ -23,28 +23,40 @@ condition: >
2323
maxspan 2m
2424
by ps.uuid
2525
|spawn_process and
26-
ps.exe != '' and
27-
not
28-
(
29-
ps.exe imatches
30-
(
31-
'?:\\Windows\\System32\\MDMAppInstaller.exe',
32-
'?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe',
33-
'?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe',
34-
'?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe',
35-
'?:\\Program Files\\*.exe',
36-
'?:\\Program Files (x86)\\*.exe',
37-
'?:\\Windows\\winsxs\\*\\TiWorker.exe'
38-
) or
39-
(ps.exe imatches '?:\\WINDOWS\\System32\\taskhostw.exe' and ps.parent.args intersects ('-k', 'netsvcs', '-p', '-s', 'Schedule')) or
40-
(ps.exe imatches '?:\\Windows\\System32\\RuntimeBroker.exe') or
41-
(ps.exe imatches ('?:\\Program Files\\WindowsApps\\Microsoft.*.exe', '?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe')) or
42-
(ps.exe imatches '?:\\WINDOWS\\system32\\BackgroundTaskHost.exe' and ps.args imatches ('-ServerName:*')) or
43-
(ps.exe imatches '?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe') or
44-
(ps.exe imatches '?:\\WINDOWS\\uus\\*\\MoUsoCoreWorker.exe') or
45-
(ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') or
46-
(ps.parent.exe imatches '?:\\Program Files\\Microsoft OneDrive\\OneDriveStandaloneUpdater.exe')
47-
)
26+
ps.sid not in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20') and ps.exe != '' and
27+
not (ps.exe imatches
28+
(
29+
'?:\\Windows\\System32\\MDMAppInstaller.exe',
30+
'?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe',
31+
'?:\\Windows\\uus\\*\\WaaSMedicAgent.exe',
32+
'?:\\Windows\\System32\\UCConfigTask.exe',
33+
'?:\\Windows\\System32\\DllHost.exe',
34+
'?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe',
35+
'?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe',
36+
'?:\\Program Files\\*.exe',
37+
'?:\\Program Files (x86)\\*.exe',
38+
'?:\\Windows\\winsxs\\*\\TiWorker.exe',
39+
'?:\\Windows\\System32\\RuntimeBroker.exe',
40+
'?:\\WINDOWS\\system32\\UCConfigTask.exe',
41+
'?:\\Program Files\\WindowsApps\\Microsoft.*.exe',
42+
'?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe',
43+
'?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe',
44+
'?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe',
45+
'?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe',
46+
'?:\\Windows\\System32\\PickerHost.exe',
47+
'?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe',
48+
'?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\AppActions.exe',
49+
'?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe',
50+
'?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe',
51+
'?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe',
52+
'?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe',
53+
'?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe'
54+
) or
55+
(ps.exe imatches '?:\\WINDOWS\\System32\\taskhostw.exe' and ps.parent.args intersects ('-k', 'netsvcs', '-p', '-s', 'Schedule')) or
56+
(ps.exe imatches '?:\\WINDOWS\\system32\\BackgroundTaskHost.exe' and ps.args imatches ('-ServerName:*')) or
57+
(ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') or
58+
(ps.parent.exe imatches '?:\\Program Files\\Microsoft OneDrive\\OneDriveStandaloneUpdater.exe')
59+
)
4860
|
4961
|load_dll and dll.name ~= 'vaultcli.dll'|
5062

‎rules/credential_access_unusual_access_to_ssh_keys.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Unusual access to SSH keys
22
id: 90f5c1bd-abd6-4d1b-94e0-229f04473d60
3-
version: 1.0.5
3+
version: 1.0.6
44
description: |
55
Identifies access by unusual process to saved SSH keys.
66
labels:
@@ -16,7 +16,7 @@ labels:
1616

1717
condition: >
1818
open_file and
19-
file.path imatches '?:\\Users\\*\\.ssh\\known_hosts' and
19+
evt.pid != 4 and file.path imatches '?:\\Users\\*\\.ssh\\known_hosts' and
2020
ps.exe not imatches
2121
(
2222
'?:\\Program Files\\*',

‎rules/credential_access_unusual_access_to_web_browser_credential_stores.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Unusual access to Web Browser Credential stores
22
id: 9d889b2b-ca13-4a04-8919-ff1151f23a71
3-
version: 1.0.4
3+
version: 1.0.5
44
description: |
55
Identifies access to Web Browser Credential stores by unusual processes.
66
labels:
@@ -16,16 +16,18 @@ labels:
1616

1717
condition: >
1818
open_file and
19-
file.path imatches web_browser_cred_stores and
19+
evt.pid != 4 and file.path imatches web_browser_cred_stores and
2020
ps.name not iin web_browser_binaries and
2121
ps.exe not imatches
2222
(
2323
'?:\\Program Files\\*',
2424
'?:\\Program Files(x86)\\*',
25-
'*\\Windows\\System32\\SearchProtocolHost.exe',
26-
'*\\Windows\\explorer.exe',
25+
'?:\\Windows\\System32\\SearchProtocolHost.exe',
26+
'?:\\Windows\\explorer.exe',
2727
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
28-
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MpCopyAccelerator.exe'
28+
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MpCopyAccelerator.exe',
29+
'?:\\Windows\\System32\\svchost.exe',
30+
'?:\\Windows\\System32\\taskhostw.exe'
2931
)
3032
3133
min-engine-version: 3.0.0

‎rules/defense_evasion_activity_from_unhooked_ntdll_module.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Activity from unhooked NTDLL module
22
id: 24f48f6c-9d97-498d-badc-65e179d19599
3-
version: 1.1.0
3+
version: 1.1.1
44
description: |
55
Detects suspicious activity originating from an unhooked or manually mapped copy of NTDLL loaded
66
into a process. This behavior is commonly associated with defense evasion frameworks that bypass
@@ -58,7 +58,6 @@ condition: >
5858
|((spawn_process) or
5959
(load_module) or
6060
(create_file) or
61-
(set_thread_context) or
6261
(create_remote_thread) or
6362
(set_value) or
6463
(rename_file) or

‎rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml‎

Lines changed: 33 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: .NET assembly loaded by unmanaged process
22
id: 34be8bd1-1143-4fa8-bed4-ae2566b1394a
3-
version: 1.0.11
3+
version: 1.2.0
44
description: |
55
Identifies the loading of the .NET assembly by an unmanaged process. Adversaries can load the CLR runtime
66
inside unmanaged process and execute the assembly via the ICLRRuntimeHost::ExecuteInDefaultAppDomain method.
@@ -16,31 +16,47 @@ references:
1616
- https://www.ired.team/offensive-security/code-injection-process-injection/injecting-and-executing-.net-assemblies-to-unmanaged-process
1717

1818
condition: >
19-
(load_unsigned_or_untrusted_module) and
20-
dll.path not imatches
21-
(
22-
'?:\\Windows\\assembly\\*\\*.ni.dll',
23-
'?:\\Program Files\\WindowsPowerShell\\Modules\\*\\*.dll',
24-
'?:\\Windows\\Microsoft.NET\\assembly\\*\\*.dll',
25-
'?:\\$WinREAgent\\Scratch\\*',
26-
'?:\\Windows\\WinSxS\\*',
27-
'?:\\Windows\\CbsTemp\\*',
28-
'?:\\Windows\\SoftwareDistribution\\*'
29-
) and
30-
ps.exe != '' and ps.pe.is_dotnet = false and
31-
(dll.pe.is_dotnet or thread.callstack.modules imatches ('*clr.dll')) and
32-
ps.exe not imatches
19+
sequence
20+
maxspan 1m
21+
by ps.uuid
22+
|spawn_process and
23+
ps.token.integrity_level != 'SYSTEM' and
24+
ps.exe not imatches
3325
(
26+
'?:\\Windows\\system32\\DllHost.exe',
27+
'?:\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe',
3428
'?:\\Program Files\\WindowsApps\\*\\CrossDeviceService.exe',
3529
'?:\\Program Files\\WindowsApps\\*\\WidgetService.exe',
3630
'?:\\Program Files\\WindowsApps\\*\\PhoneExperienceHost.exe',
3731
'?:\\Program Files\\WindowsApps\\*\\WindowsSandboxServer.exe',
3832
'?:\\Program Files\\Conexant\\SAII\\SmartAudio.exe',
39-
'?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe'
33+
'?:\\Program Files\\WindowsApps\\Microsoft.WinDbg_*\\*.exe',
34+
'?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe',
35+
'?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe',
36+
'?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe',
37+
'?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe',
38+
'?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\WinStore.DesktopExtension\\StoreDesktopExtension.exe'
4039
)
40+
|
41+
|(load_unsigned_or_untrusted_module) and
42+
dll.path not imatches
43+
(
44+
'?:\\Windows\\System32\\*.dll',
45+
'?:\\Windows\\assembly\\*\\*.ni.dll',
46+
'?:\\Program Files\\WindowsPowerShell\\Modules\\*\\*.dll',
47+
'?:\\Windows\\Microsoft.NET\\assembly\\*\\*.dll',
48+
'?:\\$WinREAgent\\Scratch\\*.dll',
49+
'?:\\Windows\\WinSxS\\*.dll',
50+
'?:\\Windows\\CbsTemp\\*.dll',
51+
'?:\\Windows\\SoftwareDistribution\\*.dll',
52+
'?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\*.dll'
53+
) and
54+
ps.exe != '' and ps.pe.is_dotnet = false and
55+
(dll.pe.is_dotnet or thread.callstack.modules imatches ('*clr.dll'))
56+
|
4157
4258
output: >
43-
.NET assembly %dll.path loaded by unmanaged process %ps.exe
59+
.NET assembly %2.dll.path loaded by unmanaged process %2.ps.exe
4460
severity: high
4561

4662
min-engine-version: 3.0.0

0 commit comments

Comments
 (0)