Skip to content

Commit f63cbf2

Browse files
wagga40wagga40
committed
Rules Update
1 parent 802eb4d commit f63cbf2

11 files changed

+315
-191
lines changed

‎rules_windows_generic.json

-19
Original file line numberDiff line numberDiff line change
@@ -26116,25 +26116,6 @@
2611626116
],
2611726117
"filename": "image_load_side_load_abused_dlls_susp_paths.yml"
2611826118
},
26119-
{
26120-
"title": "Possible Process Hollowing Image Loading",
26121-
"id": "e32ce4f5-46c6-4c47-ba69-5de3c9193cd7",
26122-
"status": "test",
26123-
"description": "Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz",
26124-
"author": "Markus Neis",
26125-
"tags": [
26126-
"attack.defense_evasion",
26127-
"attack.t1574.002"
26128-
],
26129-
"falsepositives": [
26130-
"Very likely, needs more tuning"
26131-
],
26132-
"level": "high",
26133-
"rule": [
26134-
"SELECT * FROM logs WHERE (NewProcessName LIKE '%\\\\notepad.exe' ESCAPE '\\' AND (ImageLoaded LIKE '%\\\\samlib.dll' ESCAPE '\\' OR ImageLoaded LIKE '%\\\\WinSCard.dll' ESCAPE '\\'))"
26135-
],
26136-
"filename": "image_load_susp_uncommon_image_load.yml"
26137-
},
2613826119
{
2613926120
"title": "UAC Bypass With Fake DLL",
2614026121
"id": "a5ea83a7-05a5-44c1-be2e-addccbbd8c03",

‎rules_windows_generic_full.json

+59-19
Original file line numberDiff line numberDiff line change
@@ -37500,6 +37500,25 @@
3750037500
],
3750137501
"filename": "proc_creation_win_sysinternals_procdump_evasion.yml"
3750237502
},
37503+
{
37504+
"title": "CodePage Modification Via MODE.COM To Russian Language",
37505+
"id": "12fbff88-16b5-4b42-9754-cd001a789fb3",
37506+
"status": "experimental",
37507+
"description": "Detects a CodePage modification using the \"mode.com\" utility to Russian language.\nThis behavior has been used by threat actors behind Dharma ransomware.\n",
37508+
"author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
37509+
"tags": [
37510+
"attack.defense_evasion",
37511+
"attack.t1036"
37512+
],
37513+
"falsepositives": [
37514+
"Russian speaking people changing the CodePage"
37515+
],
37516+
"level": "medium",
37517+
"rule": [
37518+
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\mode.com' ESCAPE '\\' OR OriginalFileName = 'MODE.COM') AND (CommandLine LIKE '% con %' ESCAPE '\\' AND CommandLine LIKE '% cp %' ESCAPE '\\' AND CommandLine LIKE '% select=%' ESCAPE '\\' AND (CommandLine LIKE '%=1251' ESCAPE '\\' OR CommandLine LIKE '%=866' ESCAPE '\\')))"
37519+
],
37520+
"filename": "proc_creation_win_mode_codepage_russian.yml"
37521+
},
3750337522
{
3750437523
"title": "Non Interactive PowerShell Process Spawned",
3750537524
"id": "f4bbd493-b796-416e-bbf2-121235348529",
@@ -46130,25 +46149,6 @@
4613046149
],
4613146150
"filename": "image_load_side_load_abused_dlls_susp_paths.yml"
4613246151
},
46133-
{
46134-
"title": "Possible Process Hollowing Image Loading",
46135-
"id": "e32ce4f5-46c6-4c47-ba69-5de3c9193cd7",
46136-
"status": "test",
46137-
"description": "Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz",
46138-
"author": "Markus Neis",
46139-
"tags": [
46140-
"attack.defense_evasion",
46141-
"attack.t1574.002"
46142-
],
46143-
"falsepositives": [
46144-
"Very likely, needs more tuning"
46145-
],
46146-
"level": "high",
46147-
"rule": [
46148-
"SELECT * FROM logs WHERE (NewProcessName LIKE '%\\\\notepad.exe' ESCAPE '\\' AND (ImageLoaded LIKE '%\\\\samlib.dll' ESCAPE '\\' OR ImageLoaded LIKE '%\\\\WinSCard.dll' ESCAPE '\\'))"
46149-
],
46150-
"filename": "image_load_susp_uncommon_image_load.yml"
46151-
},
4615246152
{
4615346153
"title": "UAC Bypass With Fake DLL",
4615446154
"id": "a5ea83a7-05a5-44c1-be2e-addccbbd8c03",
@@ -46853,6 +46853,26 @@
4685346853
],
4685446854
"filename": "image_load_side_load_cpl_from_non_system_location.yml"
4685546855
},
46856+
{
46857+
"title": "Unsigned DLL Loaded by RunDLL32/RegSvr32",
46858+
"id": "b5de0c9a-6f19-43e0-af4e-55ad01f550af",
46859+
"status": "experimental",
46860+
"description": "Detects RunDLL32/RegSvr32 loading an unsigned or untrusted DLL.\nAdversaries often abuse those programs to proxy execution of malicious code.\n",
46861+
"author": "Swachchhanda Shrawan Poudel",
46862+
"tags": [
46863+
"attack.t1218.011",
46864+
"attack.t1218.010",
46865+
"attack.defense_evasion"
46866+
],
46867+
"falsepositives": [
46868+
"Unknown"
46869+
],
46870+
"level": "medium",
46871+
"rule": [
46872+
"SELECT * FROM logs WHERE ((NewProcessName LIKE '%\\\\regsvr32.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\rundll32.exe' ESCAPE '\\') AND NOT ((Signed = 'true' OR (SignatureStatus LIKE 'errorChaining' ESCAPE '\\' OR SignatureStatus LIKE 'errorCode\\_endpoint' ESCAPE '\\' OR SignatureStatus LIKE 'errorExpired' ESCAPE '\\' OR SignatureStatus LIKE 'trusted' ESCAPE '\\'))))"
46873+
],
46874+
"filename": "image_load_susp_unsigned_dll.yml"
46875+
},
4685646876
{
4685746877
"title": "VMMap Signed Dbghelp.DLL Potential Sideloading",
4685846878
"id": "98ffaed4-aec2-4e04-9b07-31492fe68b3d",
@@ -49293,6 +49313,26 @@
4929349313
],
4929449314
"filename": "proc_creation_win_taskkill_execution.yml"
4929549315
},
49316+
{
49317+
"title": "CodePage Modification Via MODE.COM",
49318+
"id": "d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e",
49319+
"status": "experimental",
49320+
"description": "Detects a CodePage modification using the \"mode.com\" utility.\nThis behavior has been used by threat actors behind Dharma ransomware.\n",
49321+
"author": "Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk",
49322+
"tags": [
49323+
"attack.defense_evasion",
49324+
"attack.t1036",
49325+
"detection.threat_hunting"
49326+
],
49327+
"falsepositives": [
49328+
"Unknown"
49329+
],
49330+
"level": "low",
49331+
"rule": [
49332+
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\mode.com' ESCAPE '\\' OR OriginalFileName = 'MODE.COM') AND (CommandLine LIKE '% con %' ESCAPE '\\' AND CommandLine LIKE '% cp %' ESCAPE '\\' AND CommandLine LIKE '% select=%' ESCAPE '\\'))"
49333+
],
49334+
"filename": "proc_creation_win_mode_codepage_change.yml"
49335+
},
4929649336
{
4929749337
"title": "PsExec Default Named Pipe",
4929849338
"id": "f3f3a972-f982-40ad-b63c-bca6afdfad7c",

‎rules_windows_generic_high.json

-19
Original file line numberDiff line numberDiff line change
@@ -26116,25 +26116,6 @@
2611626116
],
2611726117
"filename": "image_load_side_load_abused_dlls_susp_paths.yml"
2611826118
},
26119-
{
26120-
"title": "Possible Process Hollowing Image Loading",
26121-
"id": "e32ce4f5-46c6-4c47-ba69-5de3c9193cd7",
26122-
"status": "test",
26123-
"description": "Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz",
26124-
"author": "Markus Neis",
26125-
"tags": [
26126-
"attack.defense_evasion",
26127-
"attack.t1574.002"
26128-
],
26129-
"falsepositives": [
26130-
"Very likely, needs more tuning"
26131-
],
26132-
"level": "high",
26133-
"rule": [
26134-
"SELECT * FROM logs WHERE (NewProcessName LIKE '%\\\\notepad.exe' ESCAPE '\\' AND (ImageLoaded LIKE '%\\\\samlib.dll' ESCAPE '\\' OR ImageLoaded LIKE '%\\\\WinSCard.dll' ESCAPE '\\'))"
26135-
],
26136-
"filename": "image_load_susp_uncommon_image_load.yml"
26137-
},
2613826119
{
2613926120
"title": "UAC Bypass With Fake DLL",
2614026121
"id": "a5ea83a7-05a5-44c1-be2e-addccbbd8c03",

‎rules_windows_generic_medium.json

+39-19
Original file line numberDiff line numberDiff line change
@@ -35132,6 +35132,25 @@
3513235132
],
3513335133
"filename": "proc_creation_win_sysinternals_procdump_evasion.yml"
3513435134
},
35135+
{
35136+
"title": "CodePage Modification Via MODE.COM To Russian Language",
35137+
"id": "12fbff88-16b5-4b42-9754-cd001a789fb3",
35138+
"status": "experimental",
35139+
"description": "Detects a CodePage modification using the \"mode.com\" utility to Russian language.\nThis behavior has been used by threat actors behind Dharma ransomware.\n",
35140+
"author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
35141+
"tags": [
35142+
"attack.defense_evasion",
35143+
"attack.t1036"
35144+
],
35145+
"falsepositives": [
35146+
"Russian speaking people changing the CodePage"
35147+
],
35148+
"level": "medium",
35149+
"rule": [
35150+
"SELECT * FROM logs WHERE ((EventID = '4688' AND Channel = 'Security') AND (NewProcessName LIKE '%\\\\mode.com' ESCAPE '\\' OR OriginalFileName = 'MODE.COM') AND (CommandLine LIKE '% con %' ESCAPE '\\' AND CommandLine LIKE '% cp %' ESCAPE '\\' AND CommandLine LIKE '% select=%' ESCAPE '\\' AND (CommandLine LIKE '%=1251' ESCAPE '\\' OR CommandLine LIKE '%=866' ESCAPE '\\')))"
35151+
],
35152+
"filename": "proc_creation_win_mode_codepage_russian.yml"
35153+
},
3513535154
{
3513635155
"title": "MpiExec Lolbin",
3513735156
"id": "729ce0ea-5d8f-4769-9762-e35de441586d",
@@ -43329,25 +43348,6 @@
4332943348
],
4333043349
"filename": "image_load_side_load_abused_dlls_susp_paths.yml"
4333143350
},
43332-
{
43333-
"title": "Possible Process Hollowing Image Loading",
43334-
"id": "e32ce4f5-46c6-4c47-ba69-5de3c9193cd7",
43335-
"status": "test",
43336-
"description": "Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz",
43337-
"author": "Markus Neis",
43338-
"tags": [
43339-
"attack.defense_evasion",
43340-
"attack.t1574.002"
43341-
],
43342-
"falsepositives": [
43343-
"Very likely, needs more tuning"
43344-
],
43345-
"level": "high",
43346-
"rule": [
43347-
"SELECT * FROM logs WHERE (NewProcessName LIKE '%\\\\notepad.exe' ESCAPE '\\' AND (ImageLoaded LIKE '%\\\\samlib.dll' ESCAPE '\\' OR ImageLoaded LIKE '%\\\\WinSCard.dll' ESCAPE '\\'))"
43348-
],
43349-
"filename": "image_load_susp_uncommon_image_load.yml"
43350-
},
4335143351
{
4335243352
"title": "UAC Bypass With Fake DLL",
4335343353
"id": "a5ea83a7-05a5-44c1-be2e-addccbbd8c03",
@@ -44032,6 +44032,26 @@
4403244032
],
4403344033
"filename": "image_load_side_load_cpl_from_non_system_location.yml"
4403444034
},
44035+
{
44036+
"title": "Unsigned DLL Loaded by RunDLL32/RegSvr32",
44037+
"id": "b5de0c9a-6f19-43e0-af4e-55ad01f550af",
44038+
"status": "experimental",
44039+
"description": "Detects RunDLL32/RegSvr32 loading an unsigned or untrusted DLL.\nAdversaries often abuse those programs to proxy execution of malicious code.\n",
44040+
"author": "Swachchhanda Shrawan Poudel",
44041+
"tags": [
44042+
"attack.t1218.011",
44043+
"attack.t1218.010",
44044+
"attack.defense_evasion"
44045+
],
44046+
"falsepositives": [
44047+
"Unknown"
44048+
],
44049+
"level": "medium",
44050+
"rule": [
44051+
"SELECT * FROM logs WHERE ((NewProcessName LIKE '%\\\\regsvr32.exe' ESCAPE '\\' OR NewProcessName LIKE '%\\\\rundll32.exe' ESCAPE '\\') AND NOT ((Signed = 'true' OR (SignatureStatus LIKE 'errorChaining' ESCAPE '\\' OR SignatureStatus LIKE 'errorCode\\_endpoint' ESCAPE '\\' OR SignatureStatus LIKE 'errorExpired' ESCAPE '\\' OR SignatureStatus LIKE 'trusted' ESCAPE '\\'))))"
44052+
],
44053+
"filename": "image_load_susp_unsigned_dll.yml"
44054+
},
4403544055
{
4403644056
"title": "VMMap Signed Dbghelp.DLL Potential Sideloading",
4403744057
"id": "98ffaed4-aec2-4e04-9b07-31492fe68b3d",

‎rules_windows_generic_pysigma.json

+59-19
Original file line numberDiff line numberDiff line change
@@ -25975,25 +25975,6 @@
2597525975
],
2597625976
"filename": ""
2597725977
},
25978-
{
25979-
"title": "Possible Process Hollowing Image Loading",
25980-
"id": "e32ce4f5-46c6-4c47-ba69-5de3c9193cd7",
25981-
"status": "test",
25982-
"description": "Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz",
25983-
"author": "Markus Neis",
25984-
"tags": [
25985-
"attack.defense_evasion",
25986-
"attack.t1574.002"
25987-
],
25988-
"falsepositives": [
25989-
"Very likely, needs more tuning"
25990-
],
25991-
"level": "high",
25992-
"rule": [
25993-
"SELECT * FROM logs WHERE Image LIKE '%\\\\notepad.exe' ESCAPE '\\' AND (ImageLoaded LIKE '%\\\\samlib.dll' ESCAPE '\\' OR ImageLoaded LIKE '%\\\\WinSCard.dll' ESCAPE '\\')"
25994-
],
25995-
"filename": ""
25996-
},
2599725978
{
2599825979
"title": "UAC Bypass With Fake DLL",
2599925980
"id": "a5ea83a7-05a5-44c1-be2e-addccbbd8c03",
@@ -30994,6 +30975,26 @@
3099430975
],
3099530976
"filename": ""
3099630977
},
30978+
{
30979+
"title": "CodePage Modification Via MODE.COM",
30980+
"id": "d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e",
30981+
"status": "experimental",
30982+
"description": "Detects a CodePage modification using the \"mode.com\" utility.\nThis behavior has been used by threat actors behind Dharma ransomware.\n",
30983+
"author": "Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk",
30984+
"tags": [
30985+
"attack.defense_evasion",
30986+
"attack.t1036",
30987+
"detection.threat_hunting"
30988+
],
30989+
"falsepositives": [
30990+
"Unknown"
30991+
],
30992+
"level": "low",
30993+
"rule": [
30994+
"SELECT * FROM logs WHERE Channel='Security' AND (EventID=4688 AND ((NewProcessName LIKE '%\\\\mode.com' ESCAPE '\\' OR OriginalFileName='MODE.COM') AND (CommandLine LIKE '% con %' ESCAPE '\\' AND CommandLine LIKE '% cp %' ESCAPE '\\' AND CommandLine LIKE '% select=%' ESCAPE '\\')))"
30995+
],
30996+
"filename": ""
30997+
},
3099730998
{
3099830999
"title": "PsExec Default Named Pipe",
3099931000
"id": "f3f3a972-f982-40ad-b63c-bca6afdfad7c",
@@ -44444,6 +44445,25 @@
4444444445
],
4444544446
"filename": ""
4444644447
},
44448+
{
44449+
"title": "CodePage Modification Via MODE.COM To Russian Language",
44450+
"id": "12fbff88-16b5-4b42-9754-cd001a789fb3",
44451+
"status": "experimental",
44452+
"description": "Detects a CodePage modification using the \"mode.com\" utility to Russian language.\nThis behavior has been used by threat actors behind Dharma ransomware.\n",
44453+
"author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
44454+
"tags": [
44455+
"attack.defense_evasion",
44456+
"attack.t1036"
44457+
],
44458+
"falsepositives": [
44459+
"Russian speaking people changing the CodePage"
44460+
],
44461+
"level": "medium",
44462+
"rule": [
44463+
"SELECT * FROM logs WHERE Channel='Security' AND (EventID=4688 AND ((NewProcessName LIKE '%\\\\mode.com' ESCAPE '\\' OR OriginalFileName='MODE.COM') AND ((CommandLine LIKE '% con %' ESCAPE '\\' AND CommandLine LIKE '% cp %' ESCAPE '\\' AND CommandLine LIKE '% select=%' ESCAPE '\\') AND (CommandLine LIKE '%=1251' ESCAPE '\\' OR CommandLine LIKE '%=866' ESCAPE '\\'))))"
44464+
],
44465+
"filename": ""
44466+
},
4444744467
{
4444844468
"title": "Pubprn.vbs Proxy Execution",
4444944469
"id": "1fb76ab8-fa60-4b01-bddd-71e89bf555da",
@@ -48634,6 +48654,26 @@
4863448654
],
4863548655
"filename": ""
4863648656
},
48657+
{
48658+
"title": "Unsigned DLL Loaded by RunDLL32/RegSvr32",
48659+
"id": "b5de0c9a-6f19-43e0-af4e-55ad01f550af",
48660+
"status": "experimental",
48661+
"description": "Detects RunDLL32/RegSvr32 loading an unsigned or untrusted DLL.\nAdversaries often abuse those programs to proxy execution of malicious code.\n",
48662+
"author": "Swachchhanda Shrawan Poudel",
48663+
"tags": [
48664+
"attack.t1218.011",
48665+
"attack.t1218.010",
48666+
"attack.defense_evasion"
48667+
],
48668+
"falsepositives": [
48669+
"Unknown"
48670+
],
48671+
"level": "medium",
48672+
"rule": [
48673+
"SELECT * FROM logs WHERE (Image LIKE '%\\\\regsvr32.exe' ESCAPE '\\' OR Image LIKE '%\\\\rundll32.exe' ESCAPE '\\') AND (NOT (Signed='true' OR (SignatureStatus='errorChaining' OR SignatureStatus LIKE 'errorCode\\_endpoint' ESCAPE '\\' OR SignatureStatus='errorExpired' OR SignatureStatus='trusted')))"
48674+
],
48675+
"filename": ""
48676+
},
4863748677
{
4863848678
"title": "VMMap Signed Dbghelp.DLL Potential Sideloading",
4863948679
"id": "98ffaed4-aec2-4e04-9b07-31492fe68b3d",

‎rules_windows_sysmon.json

-19
Original file line numberDiff line numberDiff line change
@@ -26116,25 +26116,6 @@
2611626116
],
2611726117
"filename": "image_load_side_load_abused_dlls_susp_paths.yml"
2611826118
},
26119-
{
26120-
"title": "Possible Process Hollowing Image Loading",
26121-
"id": "e32ce4f5-46c6-4c47-ba69-5de3c9193cd7",
26122-
"status": "test",
26123-
"description": "Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz",
26124-
"author": "Markus Neis",
26125-
"tags": [
26126-
"attack.defense_evasion",
26127-
"attack.t1574.002"
26128-
],
26129-
"falsepositives": [
26130-
"Very likely, needs more tuning"
26131-
],
26132-
"level": "high",
26133-
"rule": [
26134-
"SELECT * FROM logs WHERE (EventID = '7' AND Channel = 'Microsoft-Windows-Sysmon/Operational' AND Image LIKE '%\\\\notepad.exe' ESCAPE '\\' AND (ImageLoaded LIKE '%\\\\samlib.dll' ESCAPE '\\' OR ImageLoaded LIKE '%\\\\WinSCard.dll' ESCAPE '\\'))"
26135-
],
26136-
"filename": "image_load_susp_uncommon_image_load.yml"
26137-
},
2613826119
{
2613926120
"title": "UAC Bypass With Fake DLL",
2614026121
"id": "a5ea83a7-05a5-44c1-be2e-addccbbd8c03",

0 commit comments

Comments
 (0)