Merge PR #4631 from @nasbench - add rules related to CISA aa23-347a…

… advisory and other updates new: DLL Names Used By SVR For GraphicalProton Backdoor new: Enable LM Hash Storage new: Enable LM Hash Storage - ProcCreation new: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor new: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler update: Compress-Archive Cmdlet Execution - Reudced Level to low and moved to Threat Hunting folder. update: Disabled Volume Snapshots - Update logic by removing the reg string to also account for potential renamed executions update: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet - Update logic to be more specific update: Potential Recon Activity Via Nltest.EXE - Add dnsgetdc coverage and enhance logic by removing / update: Potential System DLL Sideloading From Non System Locations - Enhance logic by removing hardcoded C: value to account for other potential system locations update: RestrictedAdminMode Registry Value Tampering - ProcCreation - Update logic the logic to not care about the data. As this registry value has use cases either be it "0" or "1" update: RestrictedAdminMode Registry Value Tampering - Update logic the logic to not care about the data. As this registry value has use cases either be it "0" or "1" update: Write Protect For Storage Disabled - Update logic by removing the reg string to also account for potential renamed executions update: Zip A Folder With PowerShell For Staging In Temp - PowerShell Module - Update logic to be more specific update: Zip A Folder With PowerShell For Staging In Temp - PowerShell - Update logic to be more specific update: Zip A Folder With PowerShell For Staging In Temp - PowerShell Script - Update logic to be more specific --------- Co-authored-by: phantinuss <[email protected]>
SigmaHQ · Dec 18, 2023 · 412edd1 · 412edd1
1 parent d652a9e
commit 412edd1
Show file tree

Hide file tree

Showing 18 changed files with 312 additions and 105 deletions.
diff --git a/rules-emerging-threats/2023/TA/Cozy-Bear/image_load_apt_cozy_bear_graphical_proton_dlls.yml b/rules-emerging-threats/2023/TA/Cozy-Bear/image_load_apt_cozy_bear_graphical_proton_dlls.yml
@@ -0,0 +1,33 @@
+title: DLL Names Used By SVR For GraphicalProton Backdoor
+id: e64c8ef3-9f98-40c8-b71e-96110991cb4c
+status: experimental
+description: Hunts known SVR-specific DLL names.
+references:
+    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
+author: CISA
+date: 2023/12/18
+logsource:
+    category: image_load
+    product: windows
+detection:
+    selection:
+        ImageLoaded|endswith:
+            - '\AclNumsInvertHost.dll'
+            - '\AddressResourcesSpec.dll'
+            - '\BlendMonitorStringBuild.dll'
+            - '\ChildPaletteConnected.dll'
+            - '\DeregisterSeekUsers.dll'
+            - '\HandleFrequencyAll.dll'
+            - '\HardSwapColor.dll'
+            - '\LengthInMemoryActivate.dll'
+            - '\ModeBitmapNumericAnimate.dll'
+            - '\ModeFolderSignMove.dll'
+            - '\ParametersNamesPopup.dll'
+            - '\PerformanceCaptionApi.dll'
+            - '\ScrollbarHandleGet.dll'
+            - '\UnregisterAncestorAppendAuto.dll'
+            - '\WowIcmpRemoveReg.dll'
+    condition: selection
+falsepositives:
+    - Unknown
+level: medium
diff --git a/rules-emerging-threats/2023/TA/Cozy-Bear/win_security_apt_cozy_bear_scheduled_tasks_name.yml b/rules-emerging-threats/2023/TA/Cozy-Bear/win_security_apt_cozy_bear_scheduled_tasks_name.yml
@@ -0,0 +1,47 @@
+title: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor
+id: 8fa65166-f463-4fd2-ad4f-1436133c52e1
+related:
+    - id: 2bfc1373-0220-4fbd-8b10-33ddafd2a142
+      type: similar
+status: experimental
+description: Hunts for known SVR-specific scheduled task names
+author: CISA
+references:
+    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
+date: 2023/12/18
+tags:
+    - attack.persistence
+logsource:
+    service: security
+    product: windows
+detection:
+    selection:
+        EventID:
+            - 4698
+            - 4699
+            - 4702
+        TaskName:
+            - '\defender'
+            - '\Microsoft\DefenderService'
+            - '\Microsoft\Windows\Application Experience\StartupAppTaskCheck'
+            - '\Microsoft\Windows\Application Experience\StartupAppTaskCkeck'
+            - '\Microsoft\Windows\ATPUpd'
+            - '\Microsoft\Windows\Data Integrity Scan\Data Integrity Update'
+            - '\Microsoft\Windows\DefenderUPDService'
+            - '\Microsoft\Windows\IISUpdateService'
+            - '\Microsoft\Windows\Speech\SpeechModelInstallTask'
+            - '\Microsoft\Windows\WiMSDFS'
+            - '\Microsoft\Windows\Windows Defender\Defender Update Service'
+            - '\Microsoft\Windows\Windows Defender\Service Update'
+            - '\Microsoft\Windows\Windows Error Reporting\CheckReporting'
+            - '\Microsoft\Windows\Windows Error Reporting\SubmitReporting'
+            - '\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart'
+            - '\Microsoft\Windows\WindowsDefenderService'
+            - '\Microsoft\Windows\WindowsDefenderService2'
+            - '\Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck'
+            - '\Microsoft\Windows\WindowsUpdate\Scheduled Check'
+            - '\WindowUpdate'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high
diff --git a/...threats/2023/TA/Cozy-Bear/win_taskscheduler_apt_cozy_bear_graphical_proton_task_names.yml b/...threats/2023/TA/Cozy-Bear/win_taskscheduler_apt_cozy_bear_graphical_proton_task_names.yml
@@ -0,0 +1,48 @@
+title: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler
+id: 2bfc1373-0220-4fbd-8b10-33ddafd2a142
+related:
+    - id: 8fa65166-f463-4fd2-ad4f-1436133c52e1 # Security-Audting Eventlog
+      type: similar
+status: experimental
+description: Hunts for known SVR-specific scheduled task names
+author: CISA
+references:
+    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
+date: 2023/12/18
+tags:
+    - attack.persistence
+logsource:
+    product: windows
+    service: taskscheduler
+    definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
+detection:
+    selection:
+        EventID:
+            - 129 # Task Created
+            - 140 # Task Updated
+            - 141 # Task Deleted
+        TaskName:
+            - '\defender'
+            - '\Microsoft\DefenderService'
+            - '\Microsoft\Windows\Application Experience\StartupAppTaskCheck'
+            - '\Microsoft\Windows\Application Experience\StartupAppTaskCkeck'
+            - '\Microsoft\Windows\ATPUpd'
+            - '\Microsoft\Windows\Data Integrity Scan\Data Integrity Update'
+            - '\Microsoft\Windows\DefenderUPDService'
+            - '\Microsoft\Windows\IISUpdateService'
+            - '\Microsoft\Windows\Speech\SpeechModelInstallTask'
+            - '\Microsoft\Windows\WiMSDFS'
+            - '\Microsoft\Windows\Windows Defender\Defender Update Service'
+            - '\Microsoft\Windows\Windows Defender\Service Update'
+            - '\Microsoft\Windows\Windows Error Reporting\CheckReporting'
+            - '\Microsoft\Windows\Windows Error Reporting\SubmitReporting'
+            - '\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStart'
+            - '\Microsoft\Windows\WindowsDefenderService'
+            - '\Microsoft\Windows\WindowsDefenderService2'
+            - '\Microsoft\Windows\WindowsUpdate\Scheduled AutoCheck'
+            - '\Microsoft\Windows\WindowsUpdate\Scheduled Check'
+            - '\WindowUpdate'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high
diff --git a/...rshell_script/posh_ps_data_compressed.yml → ...script/posh_ps_compress_archive_usage.yml b/...rshell_script/posh_ps_data_compressed.yml → ...script/posh_ps_compress_archive_usage.yml
@@ -1,26 +1,26 @@
-title: Data Compressed - PowerShell
+title: Compress-Archive Cmdlet Execution
 id: 6dc5d284-69ea-42cf-9311-fb1c3932a69a
 status: test
-description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
+description: |
+    Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files.
+    An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560/T1560.md
 author: Timur Zinniatullin, oscd.community
 date: 2019/10/21
-modified: 2022/12/25
+modified: 2023/12/15
 tags:
     - attack.exfiltration
     - attack.t1560
+    - detection.threat_hunting
 logsource:
     product: windows
     category: ps_script
     definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
-        ScriptBlockText|contains|all:
-            - '-Recurse'
-            - '|'
-            - 'Compress-Archive'
+        ScriptBlockText|contains: 'Compress-Archive'
     condition: selection
 falsepositives:
-    - Highly likely if archive operations are done via PowerShell.
+    - Likely
 level: low
diff --git a/rules/windows/image_load/image_load_side_load_from_non_system_location.yml b/rules/windows/image_load/image_load_side_load_from_non_system_location.yml
@@ -9,7 +9,7 @@ references:
     - https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md # XForceIR (SideLoadHunter Project), Chris Spehn (research WFH Dridex)
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2022/08/14
-modified: 2023/10/24
+modified: 2023/12/15
 tags:
     - attack.defense_evasion
     - attack.persistence
@@ -453,26 +453,26 @@ detection:
         Image|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
         Image|endswith: '\version.dll'
     filter_optional_office_appvpolicy:
-        Image: 'C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe'
-        ImageLoaded: 'C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll'
+        Image|endswith: ':\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe'
+        ImageLoaded|endswith: ':\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll'
     filter_optional_azure:
-        ImageLoaded|startswith: 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
+        ImageLoaded|contains: ':\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
     filter_optional_dell:
-        Image|startswith:
-            - 'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
-            - 'C:\Windows\System32\backgroundTaskHost.exe'
-        ImageLoaded|startswith: 'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
+        Image|contains:
+            - ':\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
+            - ':\Windows\System32\backgroundTaskHost.exe'
+        ImageLoaded|contains: ':\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
     filter_optional_dell_wldp:
-        Image|startswith: 'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
+        Image|contains: ':\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
         Image|endswith: '\wldp.dll'
     filter_optional_checkpoint:
-        Image|startswith:
-            - 'C:\Program Files\CheckPoint\'
-            - 'C:\Program Files (x86)\CheckPoint\'
+        Image|contains:
+            - ':\Program Files\CheckPoint\'
+            - ':\Program Files (x86)\CheckPoint\'
         Image|endswith: '\SmartConsole.exe'
-        ImageLoaded|startswith:
-            - 'C:\Program Files\CheckPoint\'
-            - 'C:\Program Files (x86)\CheckPoint\'
+        ImageLoaded|contains:
+            - ':\Program Files\CheckPoint\'
+            - ':\Program Files (x86)\CheckPoint\'
         ImageLoaded|endswith: '\PolicyManager.dll'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:

diff --git a/rules/windows/powershell/powershell_classic/posh_pc_susp_zip_compress.yml b/rules/windows/powershell/powershell_classic/posh_pc_susp_zip_compress.yml
@@ -1,15 +1,22 @@
 title: Zip A Folder With PowerShell For Staging In Temp - PowerShell
-id: 71ff406e-b633-4989-96ec-bc49d825a412
+id: 71ff406e-b633-4989-96ec-bc49d825a412 # PowerShell Classic
 related:
-    - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9
-      type: derived
+    - id: daf7eb81-35fd-410d-9d7a-657837e602bb # PowerShell Module
+      type: similar
+    - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 # PowerShell Script
+      type: similar
+    - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 # Process Creation
+      type: similar
 status: test
-description: Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration
+description: |
+    Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
+    An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
-author: frack113
+    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
+author: Nasreddine Bencherchali (Nextron Systems), frack113
 date: 2021/07/20
-modified: 2023/10/27
+modified: 2023/12/18
 tags:
     - attack.collection
     - attack.t1074.001
@@ -18,11 +25,10 @@ logsource:
     service: powershell-classic
 detection:
     selection:
-        Data|contains|all:
-            - 'Compress-Archive'
-            - ' -Path '
-            - ' -DestinationPath '
-            - '$env:TEMP\'
+        Data|contains:
+            - 'Compress-Archive -Path*-DestinationPath $env:TEMP'
+            - 'Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\'
+            - 'Compress-Archive -Path*-DestinationPath*:\Windows\Temp\'
     condition: selection
 falsepositives:
     - Unknown

diff --git a/rules/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml b/rules/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml
@@ -1,15 +1,22 @@
 title: Zip A Folder With PowerShell For Staging In Temp  - PowerShell Module
-id: daf7eb81-35fd-410d-9d7a-657837e602bb
+id: daf7eb81-35fd-410d-9d7a-657837e602bb # PowerShell Module
 related:
-    - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9
-      type: derived
+    - id: 71ff406e-b633-4989-96ec-bc49d825a412 # PowerShell Classic
+      type: similar
+    - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 # PowerShell Script
+      type: similar
+    - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 # Process Creation
+      type: similar
 status: test
-description: Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration
+description: |
+    Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
+    An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
-author: frack113
+    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
+author: Nasreddine Bencherchali (Nextron Systems), frack113
 date: 2021/07/20
-modified: 2022/12/02
+modified: 2023/12/18
 tags:
     - attack.collection
     - attack.t1074.001
@@ -18,13 +25,12 @@ logsource:
     category: ps_module
     definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
 detection:
-    selection_4103:
+    selection:
         ContextInfo|contains|all:
-            - 'Compress-Archive '
-            - ' -Path '
-            - ' -DestinationPath '
-            - '$env:TEMP\'
-    condition: selection_4103
+            - 'Compress-Archive -Path*-DestinationPath $env:TEMP'
+            - 'Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\'
+            - 'Compress-Archive -Path*-DestinationPath*:\Windows\Temp\'
+    condition: selection
 falsepositives:
     - Unknown
 level: medium
diff --git a/rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml b/rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml
@@ -1,12 +1,22 @@
 title: Zip A Folder With PowerShell For Staging In Temp - PowerShell Script
-id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9
+id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 # PowerShell Script
+related:
+    - id: 71ff406e-b633-4989-96ec-bc49d825a412 # PowerShell Classic
+      type: similar
+    - id: daf7eb81-35fd-410d-9d7a-657837e602bb # PowerShell Module
+      type: similar
+    - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 # Process Creation
+      type: similar
 status: test
-description: Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration
+description: |
+    Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
+    An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
-author: frack113
+    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
+author: Nasreddine Bencherchali (Nextron Systems), frack113
 date: 2021/07/20
-modified: 2022/12/02
+modified: 2023/12/18
 tags:
     - attack.collection
     - attack.t1074.001
@@ -15,13 +25,12 @@ logsource:
     category: ps_script
     definition: 'Requirements: Script Block Logging must be enabled'
 detection:
-    selection_4104:
-        ScriptBlockText|contains|all:
-            - 'Compress-Archive '
-            - ' -Path '
-            - ' -DestinationPath '
-            - '$env:TEMP\'
-    condition: selection_4104
+    selection:
+        ScriptBlockText|contains:
+            - 'Compress-Archive -Path*-DestinationPath $env:TEMP'
+            - 'Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\'
+            - 'Compress-Archive -Path*-DestinationPath*:\Windows\Temp\'
+    condition: selection
 falsepositives:
     - Unknown
 level: medium