Skip to content

Commit 62f9c35

Browse files
wagga40wagga40
committed
Rules Update
1 parent e8d4066 commit 62f9c35

12 files changed

+313
-603
lines changed

‎rules_linux.json

+18
Original file line numberDiff line numberDiff line change
@@ -1085,6 +1085,24 @@
10851085
],
10861086
"filename": "proc_creation_lnx_setgid_setuid.yml"
10871087
},
1088+
{
1089+
"title": "Remote Access Tool - Team Viewer Session Started On Linux Host",
1090+
"id": "1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d",
1091+
"description": "Detects the command line executed when TeamViewer starts a session started by a remote host.\nOnce a connection has been started, an investigator can verify the connection details by viewing the \"incoming_connections.txt\" log file in the TeamViewer folder.\n",
1092+
"author": "Josh Nickels, Qi Nan",
1093+
"tags": [
1094+
"attack.initial_access",
1095+
"attack.t1133"
1096+
],
1097+
"falsepositives": [
1098+
"Legitimate usage of TeamViewer"
1099+
],
1100+
"level": "low",
1101+
"rule": [
1102+
"SELECT * FROM logs WHERE (ParentImage LIKE '%/TeamViewer\\_Service' ESCAPE '\\' AND Image LIKE '%/TeamViewer\\_Desktop' ESCAPE '\\' AND CommandLine LIKE '%/TeamViewer\\_Desktop --IPCport 5939 --Module 1' ESCAPE '\\')"
1103+
],
1104+
"filename": "proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml"
1105+
},
10881106
{
10891107
"title": "Cat Sudoers",
10901108
"id": "0f79c4d2-4e1f-4683-9c36-b5469a665e06",

‎rules_windows_generic.json

+3-22
Original file line numberDiff line numberDiff line change
@@ -5833,7 +5833,7 @@
58335833
],
58345834
"level": "high",
58355835
"rule": [
5836-
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ((NewProcessName LIKE '%\\\\livekd.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\livekd64.exe' ESCAPE '\\') OR OriginalFileName = 'livekd.exe') AND (CommandLine LIKE '% /m%' ESCAPE '\\' AND CommandLine LIKE '% -m%' ESCAPE '\\'))"
5836+
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ((NewProcessName LIKE '%\\\\livekd.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\livekd64.exe' ESCAPE '\\') OR OriginalFileName = 'livekd.exe') AND (CommandLine LIKE '% -m%' ESCAPE '\\' OR CommandLine LIKE '% /m%' ESCAPE '\\'))"
58375837
],
58385838
"filename": "proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml"
58395839
},
@@ -6227,25 +6227,6 @@
62276227
],
62286228
"filename": "proc_creation_win_hktl_impacket_lateral_movement.yml"
62296229
},
6230-
{
6231-
"title": "Imports Registry Key From an ADS",
6232-
"id": "0b80ade5-6997-4b1d-99a1-71701778ea61",
6233-
"status": "test",
6234-
"description": "Detects the import of a alternate datastream to the registry with regedit.exe.",
6235-
"author": "Oddvar Moe, Sander Wiebing, oscd.community",
6236-
"tags": [
6237-
"attack.t1112",
6238-
"attack.defense_evasion"
6239-
],
6240-
"falsepositives": [
6241-
"Unknown"
6242-
],
6243-
"level": "high",
6244-
"rule": [
6245-
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ((NewProcessName LIKE '%\\\\regedit.exe' ESCAPE '\\' OR OriginalFileName = 'REGEDIT.EXE') AND ((CommandLine LIKE '% /i %' ESCAPE '\\' OR CommandLine LIKE '%.reg%' ESCAPE '\\') AND CommandLine REGEXP ':[^ \\\\]')) AND NOT ((CommandLine LIKE '% /e %' ESCAPE '\\' OR CommandLine LIKE '% /a %' ESCAPE '\\' OR CommandLine LIKE '% /c %' ESCAPE '\\' OR CommandLine LIKE '% -e %' ESCAPE '\\' OR CommandLine LIKE '% -a %' ESCAPE '\\' OR CommandLine LIKE '% -c %' ESCAPE '\\')))"
6246-
],
6247-
"filename": "proc_creation_win_regedit_import_keys_ads.yml"
6248-
},
62496230
{
62506231
"title": "HackTool - Certipy Execution",
62516232
"id": "6938366d-8954-4ddc-baff-c830b3ba8fcd",
@@ -6898,7 +6879,7 @@
68986879
],
68996880
"level": "high",
69006881
"rule": [
6901-
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\regedit.exe' ESCAPE '\\' OR OriginalFileName = 'REGEDIT.EXE') AND (CommandLine LIKE '% /E %' ESCAPE '\\' OR CommandLine LIKE '% -E %' ESCAPE '\\') AND (CommandLine LIKE '%hklm%' ESCAPE '\\' OR CommandLine LIKE '%hkey\\_local\\_machine%' ESCAPE '\\') AND (CommandLine LIKE '%\\\\system' ESCAPE '\\' OR CommandLine LIKE '%\\\\sam' ESCAPE '\\' OR CommandLine LIKE '%\\\\security' ESCAPE '\\'))"
6882+
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\regedit.exe' ESCAPE '\\' OR OriginalFileName = 'REGEDIT.EXE') AND (CommandLine LIKE '% -E %' ESCAPE '\\' OR CommandLine LIKE '% /E %' ESCAPE '\\') AND (CommandLine LIKE '%hklm%' ESCAPE '\\' OR CommandLine LIKE '%hkey\\_local\\_machine%' ESCAPE '\\') AND (CommandLine LIKE '%\\\\system' ESCAPE '\\' OR CommandLine LIKE '%\\\\sam' ESCAPE '\\' OR CommandLine LIKE '%\\\\security' ESCAPE '\\'))"
69026883
],
69036884
"filename": "proc_creation_win_regedit_export_critical_keys.yml"
69046885
},
@@ -7975,7 +7956,7 @@
79757956
],
79767957
"level": "high",
79777958
"rule": [
7978-
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\msdt.exe' ESCAPE '\\' OR OriginalFileName = 'msdt.exe') AND (CommandLine LIKE '%IT\\_BrowseForFile=%' ESCAPE '\\' OR (CommandLine LIKE '% PCWDiagnostic%' ESCAPE '\\' AND (CommandLine LIKE '% /af %' ESCAPE '\\' OR CommandLine LIKE '% -af %' ESCAPE '\\'))))"
7959+
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\msdt.exe' ESCAPE '\\' OR OriginalFileName = 'msdt.exe') AND (CommandLine LIKE '%IT\\_BrowseForFile=%' ESCAPE '\\' OR (CommandLine LIKE '% PCWDiagnostic%' ESCAPE '\\' AND (CommandLine LIKE '% -af %' ESCAPE '\\' OR CommandLine LIKE '% /af %' ESCAPE '\\'))))"
79797960
],
79807961
"filename": "proc_creation_win_msdt_arbitrary_command_execution.yml"
79817962
},

‎rules_windows_generic_full.json

+53-111
Large diffs are not rendered by default.

‎rules_windows_generic_high.json

+3-22
Original file line numberDiff line numberDiff line change
@@ -5833,7 +5833,7 @@
58335833
],
58345834
"level": "high",
58355835
"rule": [
5836-
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ((NewProcessName LIKE '%\\\\livekd.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\livekd64.exe' ESCAPE '\\') OR OriginalFileName = 'livekd.exe') AND (CommandLine LIKE '% /m%' ESCAPE '\\' AND CommandLine LIKE '% -m%' ESCAPE '\\'))"
5836+
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ((NewProcessName LIKE '%\\\\livekd.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\livekd64.exe' ESCAPE '\\') OR OriginalFileName = 'livekd.exe') AND (CommandLine LIKE '% -m%' ESCAPE '\\' OR CommandLine LIKE '% /m%' ESCAPE '\\'))"
58375837
],
58385838
"filename": "proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml"
58395839
},
@@ -6227,25 +6227,6 @@
62276227
],
62286228
"filename": "proc_creation_win_hktl_impacket_lateral_movement.yml"
62296229
},
6230-
{
6231-
"title": "Imports Registry Key From an ADS",
6232-
"id": "0b80ade5-6997-4b1d-99a1-71701778ea61",
6233-
"status": "test",
6234-
"description": "Detects the import of a alternate datastream to the registry with regedit.exe.",
6235-
"author": "Oddvar Moe, Sander Wiebing, oscd.community",
6236-
"tags": [
6237-
"attack.t1112",
6238-
"attack.defense_evasion"
6239-
],
6240-
"falsepositives": [
6241-
"Unknown"
6242-
],
6243-
"level": "high",
6244-
"rule": [
6245-
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND ((NewProcessName LIKE '%\\\\regedit.exe' ESCAPE '\\' OR OriginalFileName = 'REGEDIT.EXE') AND ((CommandLine LIKE '% /i %' ESCAPE '\\' OR CommandLine LIKE '%.reg%' ESCAPE '\\') AND CommandLine REGEXP ':[^ \\\\]')) AND NOT ((CommandLine LIKE '% /e %' ESCAPE '\\' OR CommandLine LIKE '% /a %' ESCAPE '\\' OR CommandLine LIKE '% /c %' ESCAPE '\\' OR CommandLine LIKE '% -e %' ESCAPE '\\' OR CommandLine LIKE '% -a %' ESCAPE '\\' OR CommandLine LIKE '% -c %' ESCAPE '\\')))"
6246-
],
6247-
"filename": "proc_creation_win_regedit_import_keys_ads.yml"
6248-
},
62496230
{
62506231
"title": "HackTool - Certipy Execution",
62516232
"id": "6938366d-8954-4ddc-baff-c830b3ba8fcd",
@@ -6898,7 +6879,7 @@
68986879
],
68996880
"level": "high",
69006881
"rule": [
6901-
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\regedit.exe' ESCAPE '\\' OR OriginalFileName = 'REGEDIT.EXE') AND (CommandLine LIKE '% /E %' ESCAPE '\\' OR CommandLine LIKE '% -E %' ESCAPE '\\') AND (CommandLine LIKE '%hklm%' ESCAPE '\\' OR CommandLine LIKE '%hkey\\_local\\_machine%' ESCAPE '\\') AND (CommandLine LIKE '%\\\\system' ESCAPE '\\' OR CommandLine LIKE '%\\\\sam' ESCAPE '\\' OR CommandLine LIKE '%\\\\security' ESCAPE '\\'))"
6882+
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\regedit.exe' ESCAPE '\\' OR OriginalFileName = 'REGEDIT.EXE') AND (CommandLine LIKE '% -E %' ESCAPE '\\' OR CommandLine LIKE '% /E %' ESCAPE '\\') AND (CommandLine LIKE '%hklm%' ESCAPE '\\' OR CommandLine LIKE '%hkey\\_local\\_machine%' ESCAPE '\\') AND (CommandLine LIKE '%\\\\system' ESCAPE '\\' OR CommandLine LIKE '%\\\\sam' ESCAPE '\\' OR CommandLine LIKE '%\\\\security' ESCAPE '\\'))"
69026883
],
69036884
"filename": "proc_creation_win_regedit_export_critical_keys.yml"
69046885
},
@@ -7975,7 +7956,7 @@
79757956
],
79767957
"level": "high",
79777958
"rule": [
7978-
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\msdt.exe' ESCAPE '\\' OR OriginalFileName = 'msdt.exe') AND (CommandLine LIKE '%IT\\_BrowseForFile=%' ESCAPE '\\' OR (CommandLine LIKE '% PCWDiagnostic%' ESCAPE '\\' AND (CommandLine LIKE '% /af %' ESCAPE '\\' OR CommandLine LIKE '% -af %' ESCAPE '\\'))))"
7959+
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\msdt.exe' ESCAPE '\\' OR OriginalFileName = 'msdt.exe') AND (CommandLine LIKE '%IT\\_BrowseForFile=%' ESCAPE '\\' OR (CommandLine LIKE '% PCWDiagnostic%' ESCAPE '\\' AND (CommandLine LIKE '% -af %' ESCAPE '\\' OR CommandLine LIKE '% /af %' ESCAPE '\\'))))"
79797960
],
79807961
"filename": "proc_creation_win_msdt_arbitrary_command_execution.yml"
79817962
},

0 commit comments

Comments
 (0)