mirror of
https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries
synced 2026-06-13 19:21:42 +00:00
restructure of directory contents
This commit is contained in:
@
@@ -0,0 +1,42 @@
|
||||
## Collection
|
||||
|
||||
### T1560 Archive Collected Data
|
||||
Atomics: [T1560](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560/T1560.md)
|
||||
|
||||
|
||||
### T1560.001 Archive via Utility
|
||||
Atomics: [T1560.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md)
|
||||
|
||||
|
||||
### T1123 Audio Capture
|
||||
Atomics: [T1123](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1123/T1123.md)
|
||||
|
||||
|
||||
### T1119 Automated Collection
|
||||
Atomics: [T1119](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1119/T1119.md)
|
||||
|
||||
|
||||
### T1115 Clipboard Data
|
||||
Atomics: [T1115](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1115/T1115.md)
|
||||
|
||||
|
||||
### T1056.004 Credential API Hooking
|
||||
Atomics: [T1056.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.004/T1056.004.md)
|
||||
|
||||
|
||||
### T1056.002 GUI Input Capture
|
||||
Atomics: [T1056.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.002/T1056.002.md)
|
||||
|
||||
|
||||
### T1056.001 Keylogging
|
||||
Atomics: [T1056.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.001/T1056.001.md)
|
||||
|
||||
|
||||
### T1074.001 Local Data Staging
|
||||
Atomics: [T1074.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1074.001/T1074.001.md)
|
||||
|
||||
|
||||
### T1114.001 Local Email Collection
|
||||
Atomics: [T1114.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1114.001/T1114.001.md)
|
||||
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
## Command and Control
|
||||
|
||||
### T1071.004 DNS
|
||||
Atomics: [T1071.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1071.004/T1071.004.md)
|
||||
|
||||
|
||||
### T1573 Encrypted Channel
|
||||
Atomics: [T1573](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1573/T1573.md)
|
||||
|
||||
|
||||
### T1105 Ingress Tool Transfer
|
||||
Atomics: [T1105](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md)
|
||||
|
||||
|
||||
### T1090.001 Internal Proxy
|
||||
Atomics: [T1090.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1090.001/T1090.001.md)
|
||||
|
||||
|
||||
### T1095 Non-Application Layer Protocol
|
||||
Atomics: [T1095](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1095/T1095.md)
|
||||
|
||||
|
||||
### T1571 Non-Standard Port
|
||||
Atomics: [T1571](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1571/T1571.md)
|
||||
|
||||
|
||||
### T1219 Remote Access Software
|
||||
Atomics: [T1219](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1219/T1219.md)
|
||||
|
||||
|
||||
### T1071.001 Web Protocols
|
||||
Atomics: [T1071.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1071.001/T1071.001.md)
|
||||
|
||||
|
||||
@@ -0,0 +1,79 @@
|
||||
## Credential Access
|
||||
|
||||
|
||||
### T1056.004 Credential API Hooking
|
||||
Atomics: [T1056.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.004/T1056.004.md)
|
||||
|
||||
|
||||
### T1552.001 Credentials In Files
|
||||
Atomics: [T1552.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.001/T1552.001.md)
|
||||
|
||||
|
||||
### T1555.003 Credentials from Web Browsers
|
||||
Atomics: [T1555.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/T1555.003.md)
|
||||
|
||||
|
||||
### T1552.002 Credentials in Registry
|
||||
Atomics: [T1552.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.002/T1552.002.md)
|
||||
|
||||
|
||||
### T1056.002 GUI Input Capture
|
||||
Atomics: [T1056.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.002/T1056.002.md)
|
||||
|
||||
|
||||
### T1552.006 Group Policy Preferences
|
||||
Atomics: [T1552.006](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.006/T1552.006.md)
|
||||
|
||||
|
||||
### T1558.003 Kerberoasting
|
||||
Atomics: [T1558.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1558.003/T1558.003.md)
|
||||
|
||||
|
||||
### T1056.001 Keylogging
|
||||
Atomics: [T1056.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.001/T1056.001.md)
|
||||
|
||||
|
||||
### T1003.004 LSA Secrets
|
||||
Atomics: [T1003.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.004/T1003.004.md)
|
||||
|
||||
|
||||
### T1003.001 LSASS Memory
|
||||
Atomics: [T1003.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md)
|
||||
|
||||
|
||||
### T1003.003 NTDS
|
||||
Atomics: [T1003.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md)
|
||||
|
||||
|
||||
### T1040 Network Sniffing
|
||||
Atomics: [T1040](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md)
|
||||
|
||||
|
||||
### T1003 OS Credential Dumping
|
||||
Atomics: [T1003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003/T1003.md)
|
||||
|
||||
|
||||
### T1110.002 Password Cracking
|
||||
Atomics: [T1110.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1110.002/T1110.002.md)
|
||||
|
||||
|
||||
### T1556.002 Password Filter DLL
|
||||
Atomics: [T1556.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.002/T1556.002.md)
|
||||
|
||||
|
||||
### T1110.001 Password Guessing
|
||||
Atomics: [T1110.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1110.001/T1110.001.md)
|
||||
|
||||
|
||||
### T1110.003 Password Spraying
|
||||
Atomics: [T1110.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1110.003/T1110.003.md)
|
||||
|
||||
|
||||
### T1552.004 Private Keys
|
||||
Atomics: [T1552.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.004/T1552.004.md)
|
||||
|
||||
|
||||
### T1003.002 Security Account Manager
|
||||
Atomics: [T1003.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md)
|
||||
|
||||
|
||||
@@ -0,0 +1,351 @@
|
||||
## Defense Evasion
|
||||
|
||||
### T1055.004 Asynchronous Procedure Call
|
||||
Atomics: [T1055.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055.004/T1055.004.md)
|
||||
|
||||
SentinelOne isn't great at detecting all 5 injection methods, only 1 indicator of **RemoteInjection** is caught (Agent v. 4.3.2.86, Liberty SP2). In the future you could probably look for unsigned processes with some sort of combination of **Cross Process** event types > ##.
|
||||
|
||||
Reviewing process execution data for T1055.exe, I noted 4 child calc.exe processes and 2 notepad.exe child processes with their own calc.exe children; both notepad.exe instances had 2 **Process** events despite only having one child (most with **CrossProcess** entries in_storyline but only 1 storyline_child).
|
||||
|
||||
### T1197 BITS Jobs
|
||||
Atomics: [T1197](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md)
|
||||
|
||||
The below query will find and remote content downloads from DesktopImgDownldr or BitsAdmin processes, Start-BitsTransfer cmdlet downloads, and excludes system processes and noise with SrcProcParentName Not In ().
|
||||
|
||||
```
|
||||
(( TgtProcName In Contains Anycase ("bitsadmin.exe","desktopimgdownldr.exe") AND ( TgtProcCmdLine RegExp "https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)" OR TgtProcCmdLine ContainsCIS "/setnotifycmdline " ) ) OR ( TgtProcName = "powershell.exe" AND TgtProcCmdLine ContainsCIS "Start-BitsTransfer" ) ) AND SrcProcParentName Not In ("services.exe","smss.exe","wininit.exe")
|
||||
```
|
||||
|
||||
### T1548.002 Bypass User Access Control
|
||||
Atomics: [T1548.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md)
|
||||
|
||||
Detection of UAC bypass through tampering with Shell Open for .ms-settings or .msc file types. Beyond this Atomic test, and to further UAC bypass detection, the below query includes detection for CMSTPLUA COM interface abuse by GUID. See [Security-in-bits](https://www.securityinbits.com/malware-analysis/uac-bypass-analysis-stage-1-ataware-ransomware-part-2/#footnote) for more info about CMSTPLUA COM abuse.
|
||||
|
||||
*Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths were ControlSet001\Service\bam\State\UserSettings\GUID\...*
|
||||
|
||||
```
|
||||
(SrcProcCmdLine ContainsCIS "ms-settings\shell\open\command" OR SrcProcCmdLine ContainsCIS "mscfile\shell\open\command") OR (TgtProcDisplayName = "COM Surrogate" AND TgtProcCmdLine ContainsCIS "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}")
|
||||
```
|
||||
|
||||
### T1218.003 CMSTP
|
||||
Atomics: [T1218.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.003/T1218.003.md)
|
||||
|
||||
CMSTP is rarely used within my environment, so the below detection has low false positives without filtering, though you may want to limit query to inf files located in personal/writeable directories.
|
||||
|
||||
```
|
||||
SrcProcName = "cmstp.exe" AND SrcProcCmdLine RegExp "^.*\.(inf)"
|
||||
```
|
||||
|
||||
### T1574.012 COR_PROFILER
|
||||
Atomics: [T1574.012](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.012/T1574.012.md)
|
||||
|
||||
Detection of unmanaged COR profiler hooking of .NET CLR through registry or process command.
|
||||
|
||||
```
|
||||
(SrcProcCmdScript Contains "COR_" AND SrcProcCmdScript Contains "\Environment") OR RegistryKeyPath Contains "COR_PROFILER_PATH" OR SrcProcCmdScript Contains "$env:COR_"
|
||||
```
|
||||
|
||||
### T1070.001 Clear Windows Event Logs
|
||||
Atomics: [T1070.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md)
|
||||
|
||||
Detects the clearing of EventLogs through wevtutil (concise) as well as Clear-EventLog through CommandLine and CommandScript objects. Powershell cmdlet detection returns a lot of noise for the CommandScripts object, so filtering out *SrcProcParentName* may be required.
|
||||
|
||||
```
|
||||
(TgtProcName = "wevtutil.exe" AND TgtProcCmdLine ContainsCIS "cl ") OR ((SrcProcCmdLine ContainsCIS "Clear-EventLog" OR SrcProcCmdScript ContainsCIS "Clear-EventLog") AND SrcProcParentName Not In ("WmiPrvSE.exe","PFERemediation.exe","svchost.exe"))
|
||||
```
|
||||
|
||||
### T1027.004 Compile After Delivery
|
||||
Atomics: [T1027.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.004/T1027.004.md)
|
||||
|
||||
Both Atomic tests for this technique leverage csc.exe for compilation of code. The below will detect specific compilation of executables as well as dynamic compilation through detection of csc.exe creating executable files (both dll and exe). Filter noise from later portion of query using *SrcProcParentName Not In ()*.
|
||||
|
||||
```
|
||||
(TgtProcName = "csc.exe" AND SrcProcCmdLine Contains "/target:exe") OR (SrcProcName = "csc.exe" AND TgtFileIsExecutable = "true" AND SrcProcParentName Not In ("svchost.exe"))
|
||||
```
|
||||
|
||||
### T1218.001 Compiled HTML File
|
||||
Atomics: [T1218.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md)
|
||||
|
||||
Breaking down the below query, the first section will detect Atomic Test 1 where a malicious chm file spawns a process, whereas the second half of the query detects hh.exe loading a remote payloads.
|
||||
|
||||
```
|
||||
(SrcProcName = "hh.exe" AND EventType = "Open Remote Process Handle") OR (SrcProcName = "hh.exe" AND SrcProcCmdLine RegExp "https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)")
|
||||
```
|
||||
|
||||
### T1218.002 Control Panel
|
||||
Atomics: [T1218.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.md)
|
||||
|
||||
The below query will find all cpl files outside standard directories and all cpl files executed outside of Windows directories. First portion of query may need to be dropped if there's too much noise in your environment.
|
||||
|
||||
```
|
||||
(TgtFileExtension = "cpl" AND TgtFilePath Does Not ContainCIS "C:\Windows" AND TgtFilePath Does Not ContainCIS "C:\Program Files" AND TgtFilePath Does Not ContainCIS "C:\$WINDOWS.~BT") OR (SrcProcName = "control.exe" AND SrcProcCmdLine ContainsCIS ".cpl" AND SrcProcCmdLine Does Not ContainCIS "C:\Windows")
|
||||
```
|
||||
|
||||
In the future, when Process type counts are working, it may be more accurate to detect execution of cpl files where EventType **Open Remote Process Handle** or **Duplicate Process Handle** exists, though that can be added to above for filtering but would exclude Process type data.
|
||||
|
||||
```
|
||||
SrcProcName = "rundll32.exe" AND SrcProcCmdLine ContainsCIS "Shell32.dll,Control_RunDLL" AND CrossProcOpenProcCount > 0
|
||||
```
|
||||
|
||||
### T1574.001 DLL Search Order Hijacking
|
||||
Atomics: [T1574.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.001/T1574.001.md)
|
||||
|
||||
Detection of DLL search order hijack for AMSI bypass. Search order bypasses can target more than AMSI, so this can be expanded upon greatly by switching the `ContainsCIS` to `In Contains Anycase(dll list)`.
|
||||
|
||||
```
|
||||
(FileFullName ContainsCIS "amsi.dll" AND FileFullName Does Not ContainCIS "System32") AND EventType = "File Creation"
|
||||
```
|
||||
|
||||
### T1574.002 DLL Side-Loading of Notepad++ GUP.exe
|
||||
Atomics: [T1574.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md)
|
||||
|
||||
Detection for GUP.exe side-loading a dll, where executable has a display name of "WinGup for Notepad++" and has non-standard source process. Keep an eye on Cross Process events or add `AND EventType = "Open Remote Process Handle"` to the query to narrow down target (child) process.
|
||||
|
||||
```
|
||||
TgtProcDisplayName ContainsCIS "WinGup" and SrcProcName Not In ("notepad++.exe","explorer.exe","lsass.exe","csrss.exe","svchost.exe","WerFault.exe")
|
||||
```
|
||||
|
||||
### T1078.001 Enable Guest account with RDP and Admin
|
||||
Atomics: [T1078.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.001/T1078.001.md)
|
||||
|
||||
Detects enabling of Guest account, adding Guest account to groups, as well as changing of Deny/Allow of Terminal Server connections through Registry changes.
|
||||
|
||||
```
|
||||
(SrcProcCmdLine ContainsCIS "net localgroup" AND SrcProcCmdLine ContainsCIS "guest /add") OR (SrcProcCmdLine ContainsCIS "net user" AND SrcProcCmdLine ContainsCIS "/active:yes") OR (RegistryKeyPath In Contains ("Terminal Server\AllowTSConnections","Terminal Server\DenyTSConnections") AND EventType In ("Registry Value Create","Registry Value Modified"))
|
||||
```
|
||||
|
||||
### T1140 Deobfuscate/Decode Files or Information
|
||||
Atomics: [T1140](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md)
|
||||
|
||||
This Atomic tests detections of certutil encoding and decoding of executables, and the replication of certutil for bypassing detection of executable encoding. Our query below will detected renamed certutil through matching of DisplayName, as well as encoding or decoding of exe files.
|
||||
|
||||
```
|
||||
(TgtProcName != "certutil.exe" AND TgtProcDisplayName = "CertUtil.exe") OR ( TgtProcDisplayName = "CertUtil.exe" AND (TgtProcCmdLine RegExp "^.*(-decode).*\.(exe)" OR TgtProcCmdLine RegExp "^.*(-encode).*\.(exe)") )
|
||||
```
|
||||
|
||||
### T1562.002 Disable Windows Event Logging
|
||||
Atomics: [T1562.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.md)
|
||||
|
||||
#### Atomic #1 - Disable IIS Logging
|
||||
|
||||
```
|
||||
TgtProcName = "appcmd.exe" AND TgtProcCmdLine ContainsCIS "/dontLog:true" AND TgtProcCmdLine ContainsCIS "/section:httplogging"
|
||||
```
|
||||
|
||||
#### Atomic #2 - Kill Eventlog Service Threads
|
||||
|
||||
Detection is specific to Invoke-Phant0m strings as the test uses it, and we're hoping to catch renamed and obfuscated versions by catching the TerminateThread call.
|
||||
|
||||
```
|
||||
SrcProcCmdLine ContainsCIS "Invoke-Phant0m" OR SrcProcCmdScript ContainsCIS "$Kernel32::TerminateThread($getThread" OR SrcProcCmdScript ContainsCIS "Invoke-Phant0m"
|
||||
```
|
||||
|
||||
### T1562.004 Disable or Modify System Firewall
|
||||
Atomics: [T1562.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md)
|
||||
|
||||
#### Atomic #1 - Linux
|
||||
|
||||
```
|
||||
(SrcProcName In Contains ("service","chkconfig") AND SrcProcCmdLine In Contains ("off","stop") AND SrcProcCmdLine ContainsCIS "tables") OR (TgtProcName = "systemctl" AND TgtProcCmdLine In Contains ("stop","disable") AND TgtProcCmdLine Contains "firewalld")
|
||||
```
|
||||
|
||||
#### Atomic #2 - Disable Defender Firewall
|
||||
|
||||
```
|
||||
TgtProcName = "netsh.exe" AND TgtProcCmdLine ContainsCIS "state off"
|
||||
```
|
||||
|
||||
#### Atomic #3 - Allow SMB and RDP on Defender Firewall
|
||||
|
||||
```
|
||||
(TgtProcName = "netsh.exe" AND TgtProcCmdLine ContainsCIS "remote desktop" AND TgtProcCmdLine ContainsCIS "enable=Yes") OR (TgtProcName = "netsh.exe" AND TgtProcCmdLine ContainsCIS "file and printer sharing" AND TgtProcCmdLine ContainsCIS "enable=Yes")
|
||||
```
|
||||
|
||||
#### Atomic #4 AND #5 - Open Local Port on Defender Firewall
|
||||
|
||||
```
|
||||
TgtProcName = "netsh.exe" AND TgtProcCmdLine ContainsCIS "add rule" AND TgtProcCmdLine ContainsCIS "dir=in" AND TgtProcCmdLine ContainsCIS "localport="
|
||||
```
|
||||
|
||||
#### Atomic #6 - Allow Executable Through Defender Firewall
|
||||
|
||||
```
|
||||
TgtProcName = "netsh.exe" AND TgtProcCmdLine ContainsCIS "add rule" AND TgtProcCmdLine ContainsCIS "program=" AND TgtProcCmdLine In Contains Anycase ("C:\Users","C:\Windows\Temp")
|
||||
```
|
||||
|
||||
### T1562.001 Disable or Modify Tools
|
||||
Atomics: [T1562.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md)
|
||||
|
||||
#### Atomic #1 - Disable Syslog
|
||||
|
||||
```
|
||||
TgtProcName In Contains ("service","chkconfig","systemctl") AND TgtProcCmdLine In Contains ("rsyslog stop","off rsyslog","stop rsyslog","disable rsyslog")
|
||||
```
|
||||
|
||||
#### Atomic #9 AND #10 - Disable Sysmon
|
||||
|
||||
```
|
||||
(TgtProcName = "fltmc.exe" AND TgtProcCmdLine ContainsCIS "unload SysmonDrv") OR (TgtProcName = "sysmon.exe" AND TgtProcCmdLine ContainsCIS "-u")
|
||||
```
|
||||
|
||||
#### Atomic #11 - AMSI Bypass - AMSI InitFailed
|
||||
|
||||
```
|
||||
TgtProcCmdLine ContainsCIS "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)" OR SrcProcCmdScript ContainsCIS "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)"
|
||||
```
|
||||
|
||||
#### Atomic #12 - AMSI Bypass - Remove AMSI Provider Reg Key
|
||||
|
||||
```
|
||||
RegistryPath ContainsCIS "\Microsoft\AMSI\Providers" AND EventType In ("Registry Key Delete","Registry Value Delete")
|
||||
```
|
||||
|
||||
#### Atomic #17 - Disable Microsoft Office Security Features
|
||||
|
||||
```
|
||||
(RegistryKeyPath ContainsCIS "Excel\Security" OR RegistryKeyPath ContainsCIS "Excel\Security\ProtectedView") AND RegistryKeyPath In Contains Anycase ("VBAWarnings","DisableInternetFilesInPV","DisableUnsafeLocationsInPV","DisableAttachementsInPV") AND EventType In ("Registry Value Create","Registry Value Modified")
|
||||
```
|
||||
|
||||
### T1564.001 Hidden Files and Directories
|
||||
Atomics: [T1564.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.001/T1564.001.md)
|
||||
|
||||
### T1564.003 Hidden Window
|
||||
Atomics: [T1564.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.003/T1564.003.md)
|
||||
|
||||
### T1070 Indicator Removal on Host
|
||||
Atomics: [T1070](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070/T1070.md)
|
||||
|
||||
### T1202 Indirect Command Execution
|
||||
Atomics: [T1202](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1202/T1202.md)
|
||||
|
||||
### T1553.004 Install Root Certificate
|
||||
Atomics: [T1553.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md)
|
||||
|
||||
### T1218.004 InstallUtil
|
||||
Atomics: [T1218.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md)
|
||||
|
||||
### T1127.001 MSBuild
|
||||
Atomics: [T1127.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md)
|
||||
|
||||
### T1112 Modify Registry
|
||||
Atomics: [T1112](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md)
|
||||
|
||||
### T1218.005 Mshta
|
||||
Atomics: [T1218.005](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.005/T1218.005.md)
|
||||
|
||||
SentinelOne happens to be pretty good at detecting MSHTA attacks, and *IndicatorName = "SuspiciousScript"* specifically picks out these javascript based attacks very well. The below query will detect mshta.exe spawning processes as well as URLs for remote payloads to be loaded by mshta.
|
||||
|
||||
```
|
||||
(SrcProcName = "mshta.exe" and EventType = "Open Remote Process Handle") OR (SrcProcName = "mshta.exe" AND SrcProcCmdLine RegExp "https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)")
|
||||
```
|
||||
|
||||
### T1218.007 Msiexec
|
||||
Atomics: [T1218.007](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md)
|
||||
|
||||
The below query will accurately detect execution of remote msi files by msiexec.exe. The second half of the query aims to detect processes spawned by msi files instead of dll files in the CommandLine (as that is very noisy) and may return a bit of noise within for the CrossProcess Object as some auto-update processes may be collected by this query.
|
||||
|
||||
```
|
||||
( SrcProcName = "msiexec.exe" AND SrcProcCmdLine RegExp "https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)" ) OR (SrcProcName RegExp "^.*\.(tmp)" AND EventType = "Open Remote Process Handle" AND SrcProcParentName = "msiexec.exe")
|
||||
```
|
||||
|
||||
### T1564.004 NTFS File Attributes
|
||||
Atomics: [T1564.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.004/T1564.004.md)
|
||||
|
||||
### T1070.005 Network Share Connection Removal
|
||||
Atomics: [T1070.005](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.005/T1070.005.md)
|
||||
|
||||
### T1027 Obfuscated Files or Information
|
||||
Atomics: [T1027](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md)
|
||||
|
||||
### T1218.008 Odbcconf
|
||||
Atomics: [T1218.008](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.008/T1218.008.md)
|
||||
|
||||
### T1134.004 Parent PID Spoofing
|
||||
Atomics: [T1134.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.004/T1134.004.md)
|
||||
|
||||
Detects parent PID spoofing through Cross Process indicators (SrcProcParentName limits scope heavily) as well as detecting the use of PPID-Spoof powershell script through Command Scripts indicators. Update the `TgtProcName` list to filter noise.
|
||||
|
||||
```
|
||||
(TgtProcRelation = "not_in_storyline" AND EventType = "Open Remote Process Handle" AND SrcProcParentName In Contains Anycase ("userinit.exe","powershell.exe","cmd.exe") AND TgtProcName != "sihost.exe" And TgtProcIntegrityLevel != "LOW" AND TgtProcName Not In ("SystemSettings.exe")) OR (SrcProcCmdScript ContainsCIS "PPID-Spoof" AND SrcProcCmdScript ContainsCIS "hSpoofParent = [Kernel32]::OpenProcess")
|
||||
```
|
||||
|
||||
### T1550.002 Pass the Hash
|
||||
Atomics: [T1550.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.002/T1550.002.md)
|
||||
|
||||
### T1550.003 Pass the Ticket
|
||||
Atomics: [T1550.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.003/T1550.003.md)
|
||||
|
||||
### T1556.002 Password Filter DLL
|
||||
Atomics: [T1556.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.002/T1556.002.md)
|
||||
|
||||
### T1574.009 Unquoted Service Path for program.exe
|
||||
Atomics: [T1574.009](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.009/T1574.009.md)
|
||||
|
||||
Detects creation or modification of the file at `C:\program.exe` for exploiting unquoted services paths of Program Files folder.
|
||||
|
||||
```
|
||||
(FileFullName = "C:\program.exe" AND EventType In ("File Creation","File Modification")) OR TgtProcImagePath = "C:\program.exe"
|
||||
```
|
||||
|
||||
### T1055.012 Process Hollowing
|
||||
Atomics: [T1055.012](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055.012/T1055.012.md)
|
||||
|
||||
Detect Process Hollowing using the Start-Hollow powershell script, through CommandLine and CommandScript indicators.
|
||||
|
||||
The `IndicatorCategory = "Injection"` has a lot of noise, but in the future a combination of `EventType = "Duplicate Process Handle" AND TgtProcRelation = "storyline_child"` joined with some `ChildProcCount` or `CrossProcCount` > 0 may help filter the noise.
|
||||
|
||||
```
|
||||
--- Detect Start-Hollow.ps1 by command or content
|
||||
(SrcProcCmdScript ContainsCIS "Start-Hollow" AND SrcProcCmdScript ContainsCIS "[Hollow]::NtQueryInformationProcess") OR TgtProcCmdLine ContainsCIS "Start-Hollow"
|
||||
```
|
||||
|
||||
### T1055 Process Injection
|
||||
Atomics: [T1055](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055/T1055.md)
|
||||
|
||||
Detects Process Injection through execution of MavInject, filtering out noisy/expected activity. `SrcProcParentName` filter narrows Cross Process items to HQ results.
|
||||
|
||||
```
|
||||
(TgtProcName = "mavinject.exe" AND TgtProcCmdLine ContainsCIS "/injectrunning") AND (SrcProcName Not In ("AppVClient.exe") AND SrcProcParentName Not In ("smss.exe"))
|
||||
```
|
||||
|
||||
### T1218.009 PubPrn
|
||||
Atomics: [T1218.009](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1216.001/T1216.001.md)
|
||||
|
||||
### T1218.009 Regsvcs/Regasm
|
||||
Atomics: [T1218.009](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md)
|
||||
|
||||
### T1218.010 Regsvr32
|
||||
Atomics: [T1218.010](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md)
|
||||
|
||||
### T1036.003 Rename System Utilities
|
||||
Atomics: [T1036.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.md)
|
||||
|
||||
### T1207 Rogue Domain Controller
|
||||
Atomics: [T1207](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1207/T1207.md)
|
||||
|
||||
### T1014 Rootkit
|
||||
Atomics: [T1014](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1014/T1014.md)
|
||||
|
||||
### T1218.011 Rundll32
|
||||
Atomics: [T1218.011](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md)
|
||||
|
||||
### T1574.010 Services File Permissions Weakness
|
||||
Atomics: [T1574.010](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.010/T1574.010.md)
|
||||
|
||||
### T1574.011 Services Registry Permissions Weakness
|
||||
Atomics: [T1574.011](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.011/T1574.011.md)
|
||||
|
||||
### T1218 Signed Binary Proxy Execution
|
||||
Atomics: [T1218](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md)
|
||||
|
||||
### T1216 Signed Script Proxy Execution
|
||||
Atomics: [T1216](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1216/T1216.md)
|
||||
|
||||
### T1070.006 Timestomp
|
||||
Atomics: [T1070.006](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md)
|
||||
|
||||
### T1222.001 Windows File and Directory Permissions Modification
|
||||
Atomics: [T1222.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md)
|
||||
|
||||
### T1220 XSL Script Processing
|
||||
Atomics: [T1220](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md)
|
||||
@@ -0,0 +1,94 @@
|
||||
## Discovery
|
||||
|
||||
### T1010 Application Window Discovery
|
||||
Atomics: [T1010](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1010/T1010.md)
|
||||
|
||||
|
||||
### T1217 Browser Bookmark Discovery
|
||||
Atomics: [T1217](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1217/T1217.md)
|
||||
|
||||
|
||||
### T1087.002 Domain Account
|
||||
Atomics: [T1087.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1087.002/T1087.002.md)
|
||||
|
||||
|
||||
### T1069.002 Domain Groups
|
||||
Atomics: [T1069.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md)
|
||||
|
||||
|
||||
### T1482 Domain Trust Discovery
|
||||
Atomics: [T1482](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md)
|
||||
|
||||
|
||||
### T1083 File and Directory Discovery
|
||||
Atomics: [T1083](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1083/T1083.md)
|
||||
|
||||
|
||||
### T1087.001 Local Account
|
||||
Atomics: [T1087.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1087.001/T1087.001.md)
|
||||
|
||||
|
||||
### T1069.001 Local Groups
|
||||
Atomics: [T1069.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md)
|
||||
|
||||
|
||||
### T1046 Network Service Scanning
|
||||
Atomics: [T1046](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1046/T1046.md)
|
||||
|
||||
|
||||
### T1135 Network Share Discovery
|
||||
Atomics: [T1135](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1135/T1135.md)
|
||||
|
||||
|
||||
### T1040 Network Sniffing
|
||||
Atomics: [T1040](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md)
|
||||
|
||||
|
||||
### T1201 Password Policy Discovery
|
||||
Atomics: [T1201](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1201/T1201.md)
|
||||
|
||||
|
||||
### T1057 Process Discovery
|
||||
Atomics: [T1057](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1057/T1057.md)
|
||||
|
||||
|
||||
### T1012 Query Registry
|
||||
Atomics: [T1012](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1012/T1012.md)
|
||||
|
||||
|
||||
### T1018 Remote System Discovery
|
||||
Atomics: [T1018](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1018/T1018.md)
|
||||
|
||||
|
||||
### T1518.001 Security Software Discovery
|
||||
Atomics: [T1518.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1518.001/T1518.001.md)
|
||||
|
||||
|
||||
### T1518 Software Discovery
|
||||
Atomics: [T1518](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1518/T1518.md)
|
||||
|
||||
|
||||
### T1082 System Information Discovery
|
||||
Atomics: [T1082](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md)
|
||||
|
||||
|
||||
### T1016 System Network Configuration Discovery
|
||||
Atomics: [T1016](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md)
|
||||
|
||||
|
||||
### T1049 System Network Connections Discovery
|
||||
Atomics: [T1049](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md)
|
||||
|
||||
|
||||
### T1033 System Owner/User Discovery
|
||||
Atomics: [T1033](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.md)
|
||||
|
||||
|
||||
### T1007 System Service Discovery
|
||||
Atomics: [T1007](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1007/T1007.md)
|
||||
|
||||
|
||||
### T1124 System Time Discovery
|
||||
Atomics: [T1124](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1124/T1124.md)
|
||||
|
||||
|
||||
@@ -0,0 +1,85 @@
|
||||
## Execution
|
||||
|
||||
### T1053.002 AT Scheduled Task
|
||||
Atomics: [T1053.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.002/T1053.002.md)
|
||||
|
||||
Detect interactive process execution scheduled by AT command.
|
||||
|
||||
```
|
||||
TgtProcName = "at.exe" AND TgtProcCmdLine ContainsCIS "/interactive "
|
||||
```
|
||||
|
||||
### T1559.002 Dynamic Data Exchange
|
||||
Atomics: [T1559.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1559.002/T1559.002.md)
|
||||
|
||||
Latest Office 365 clients weren't executing DDE code but were providing warnings, so my simulations were unsucessful. The T1204.002 detection immediately below should cover processes spawned from Office applications.
|
||||
|
||||
### T1204.002 Malicious Documents
|
||||
Atomics: [T1204.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1204.002/T1204.002.md)
|
||||
|
||||
The tests for this technique overlap heavily with [T1566.001 Spearphishing Attachment](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/InitialAccess.md#t1566001-spearphishing-attachment) due to similar download and macro detections, so here we're focusing on detecting Office applications launching processes. The below query will cover tests 1, 3 and 4 but test [#2](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1204.002/T1204.002.md#atomic-test-2---ostap-payload-download) is standalone cscript execution and will be detected with other queries.
|
||||
|
||||
```
|
||||
(SrcProcParentName In Contains ("WINWORD.EXE","EXCEL.EXE") AND SrcProcName In Contains Anycase ("cmd.exe","cscript.exe","wscript.exe","certutil.exe","powershell.exe","msbuild.exe","csc.exe")) OR IndicatorName = "SuspiciousDocument"
|
||||
```
|
||||
|
||||
### T1106 Native API
|
||||
Atomics: [T1106](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1106/T1106.md)
|
||||
|
||||
There aren't any combination of available indicator types to query to find malicious uses of WinAPI for process execution, though this test can be detected through [T1027.004 Compile After Delivery](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/DefenseEvasion.md#t1027004-compile-after-delivery)
|
||||
|
||||
### T1059.001 PowerShell
|
||||
Atomics: [T1059.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md)
|
||||
|
||||
Most of the Atomic Tests in this case are detected by their download cradles with [T1566.001 Test 1](https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/master/Tactics/InitialAccess.md#t1566001-spearphishing-attachment) or `IndicatorName = "ObfuscatedPSCommand"`, if not other LOLBAS detection methods for later portion of command execution.
|
||||
|
||||
### T1053.005 Scheduled Tasks
|
||||
Atomics: [T1053.005](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md)
|
||||
|
||||
Our goal with this query is to detect any schtasks /create command as well as any use of the New-ScheduledTask* cmdlets from powershell, and to prevent noise from services and updates we'll exclude a list of system "trusted" SrcProcParentName executables.
|
||||
|
||||
```
|
||||
(( TgtProcName = "schtasks.exe" AND TgtProcCmdLine ContainsCIS "/create" ) OR ( SrcProcCmdLine ContainsCIS "New-ScheduledTask" OR SrcProcCmdScript ContainsCIS "New-ScheduledTask" )) AND SrcProcParentName Not In ("services.exe","OfficeClickToRun.exe")
|
||||
```
|
||||
|
||||
**Optionally, leveraging the ScheduleTaskRegister Indicator object:**
|
||||
|
||||
```
|
||||
IndicatorName = "ScheduleTaskRegister" AND SrcProcParentName Not In ("Integrator.exe","OfficeClickToRun.exe","services.exe","OneDriveSetup.exe","Ccm32BitLauncher.exe","WmiPrvSE.exe")
|
||||
```
|
||||
|
||||
### T1569.002 Service Execution
|
||||
Atomics: [T1569.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.md)
|
||||
|
||||
The tests for this Atomic are lacking, so we'll go ahead and just detect sc.exe start or start-service. PSExec belongs in lateral movement detection, so I'll ignore Test 2.
|
||||
|
||||
```
|
||||
(( SrcProcName = "sc.exe" AND SrcProcCmdLine ContainsCIS "create" ) OR SrcProcCmdLine ContainsCIS "Start-Service" ) AND SrcProcParentName != "services.exe"
|
||||
```
|
||||
|
||||
### T1059.003 Windows Command Shell
|
||||
Atomics: [T1059.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.003/T1059.003.md)
|
||||
|
||||
Atomic test cases here simulate execution of batch files, so we're querying for bat files executed from temp directories where SrcProcParentName isn't an executable we want to filter. You can recycle the T1569.005 query directly below as a different method of detecting cmd.exe execution of bat files.
|
||||
|
||||
```
|
||||
(SrcProcName = "cmd.exe" AND FileFullName ContainsCIS "\Temp" AND FileType = "bat") AND SrcProcParentName Not In ("msiexec.exe")
|
||||
```
|
||||
|
||||
### T1059.005 Visual Basic
|
||||
Atomics: [T1059.005](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.005/T1059.005.md)
|
||||
|
||||
This Atomic is just execution of vbs files, but we'll narrow this down to execution of vbs files from any Temp\ directory to be more useful.
|
||||
|
||||
```
|
||||
SrcProcName = "cscript.exe" AND SrcProcCmdLine RegExp "\bTemp\b.*\.(vbs)"
|
||||
```
|
||||
|
||||
### T1047 Windows Management Instrumentation
|
||||
Atomics: [T1047](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md)
|
||||
|
||||
The tests for this atomic are limited to execution of the wmic executable, so the below query has been limited to wmic.exe, and focuses on discovery and execution commandlines.
|
||||
|
||||
```
|
||||
( SrcProcName = "WMIC.exe" AND SrcProcCmdLine In Contains Anycase ("useraccount get","process get","qfe get","service where","process call","call create") ) AND SrcProcParentName Not In ("msiexec.exe")
|
||||
```
|
||||
@@ -0,0 +1,10 @@
|
||||
## Exfiltration
|
||||
|
||||
### T1020 Automated Exfiltration
|
||||
Atomics: [T1020](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1020/T1020.md)
|
||||
|
||||
|
||||
### T1048.003 Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
|
||||
Atomics: [T1048.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1048.003/T1048.003.md)
|
||||
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
## Impact
|
||||
|
||||
### T1531 Account Access Removal
|
||||
Atomics: [T1531](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1531/T1531.md)
|
||||
|
||||
|
||||
### T1485 Data Destruction
|
||||
Atomics: [T1485](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md)
|
||||
|
||||
|
||||
### T1490 Inhibit System Recovery
|
||||
Atomics: [T1490](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md)
|
||||
|
||||
|
||||
### T1489 Service Stop
|
||||
Atomics: [T1489](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md)
|
||||
|
||||
|
||||
### T1529 System Shutdown/Reboot
|
||||
Atomics: [T1529](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1529/T1529.md)
|
||||
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
## Initial Access
|
||||
|
||||
### T1078.001 Enable Guest account with RDP and Admin
|
||||
Atomics: [T1078.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.001/T1078.001.md)
|
||||
|
||||
Detects enabling of Guest account, adding Guest account to groups, as well as changing of Deny/Allow of Terminal Server connections through Registry changes.
|
||||
|
||||
```
|
||||
(SrcProcCmdLine ContainsCIS "net localgroup" AND SrcProcCmdLine ContainsCIS "guest /add") OR (SrcProcCmdLine ContainsCIS "net user" AND SrcProcCmdLine ContainsCIS "/active:yes") OR (RegistryKeyPath In Contains ("Terminal Server\AllowTSConnections","Terminal Server\DenyTSConnections") AND EventType In ("Registry Value Create","Registry Value Modified"))
|
||||
```
|
||||
|
||||
### T1566.001 Spearphishing Attachment
|
||||
Atomics: [T1566.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1566.001/T1566.001.md)
|
||||
|
||||
#### Test 1:
|
||||
This test merely uses Powershell to download a maldoc, the below query will find CommandLine or CommandScript downloads using multiple cradle methods as documented here by [HarmJ0y](https://gist.github.com/HarmJ0y/bb48307ffa663256e239). The below query should only be used for hunting purposes and covers most unobfuscated powershell cradles.
|
||||
|
||||
```
|
||||
(SrcProcCmdLine In Contains Anycase ("Net.WebClient","(iwr","DownloadString(","WinHttp.WinHttpRequest","IEX (","InternetExplorer.Application","Msxml2.XMLHTTP","MSXML2.ServerXMLHTTP") OR SrcProcCmdScript In Contains Anycase ("Net.WebClient","(iwr","DownloadString(","WinHttp.WinHttpRequest","IEX (","InternetExplorer.Application","Msxml2.XMLHTTP","MSXML2.ServerXMLHTTP"))
|
||||
```
|
||||
|
||||
|
||||
#### Test 2:
|
||||
This execution of macro code using Invoke-MalDoc triggers S1 T1027 Evasion Indicator, so we could RegEx on IndicatorMetadata but that'd have noise.
|
||||
|
||||
The below query should only be used for threat hunting, but it will detect Macro security settings changes to the registry for Word and Excel as well as detecting COM objects within ComandLine and CommandScript indicator objects. There may be a lot of results, focus on Indicators and Command Scripts objects as they'll have less false positives.
|
||||
|
||||
```
|
||||
(RegistryPath In Contains ("Word\Security\AccessVBOM","Excel\Security\AccessVBOM") AND EventType In ("Registry Value Create","Registry Value Modified")) OR (SrcProcCmdLine In Contains Anycase ("ActiveVBProject.VBComponents","Word.Application","Excel.Application") OR SrcProcCmdScript In Contains Anycase ("ActiveVBProject.VBComponents","Word.Application","Excel.Application"))
|
||||
```
|
||||
@@ -0,0 +1,48 @@
|
||||
## Lateral Movement
|
||||
|
||||
### T1550 Pass the Hash & Pass the Ticket
|
||||
Atomics: [T1550.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.002/T1550.002.md), [T1550.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.003/T1550.003.md)
|
||||
|
||||
Here we're focusing on detecting command line arguments of Mimikatz, so binary and powershell mimikatz will be detected assuming arguments haven't been modified before deployment.
|
||||
|
||||
```
|
||||
TgtProcCmdLine In Contains Anycase ("sekurlsa::pth","/ntlm:","kerberos::ptt")
|
||||
```
|
||||
|
||||
### T1563.002 RDP Hijacking
|
||||
Atomics: [T1563.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md)
|
||||
|
||||
Detects RDS and RemoteApp session redirections for lateral movement.
|
||||
|
||||
```
|
||||
SrcProcName = "tscon.exe" AND SrcProcCmdLine ContainsCIS "/dest:"
|
||||
```
|
||||
|
||||
### T1021.001 Scripted Lateral RDP
|
||||
Atomics: [T1021.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.001/T1021.001.md)
|
||||
|
||||
Below query will catch both Atomic tests because it focuses on detecting the use of cmdkey for authenticating RDP sessions (often used for automated lateral movement).
|
||||
|
||||
```
|
||||
TgtProcName = "cmdkey.exe" AND TgtProcCmdLine ContainsCIS "/generic:TERMSRV" AND TgtProcCmdLine ContainsCIS "/user:" AND TgtProcCmdLine ContainsCIS "/pass:"
|
||||
```
|
||||
|
||||
### T1021.002 SMB/Windows Admin Shares
|
||||
Atomics: [T1021.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.002/T1021.002.md)
|
||||
|
||||
Detecting the creation and use of may catch a lot of legitimate activity, I wouldn't recommend subscribing to this query.
|
||||
|
||||
```
|
||||
TgtProcCmdLine ContainsCIS "New-PSDrive" OR (TgtProcName = "net.exe" AND TgtProcCmdLine ContainsCIS "use ")
|
||||
```
|
||||
|
||||
### T1021.006 Windows Remote Management
|
||||
Atomics: [T1021.006](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.006/T1021.006.md)
|
||||
|
||||
The below query (in order) remote process executions through MMC, WMIC, and PsExec (by name or display name). Also of note, there are only 3 tests documented for this Atomic, yet there are 6 tests, so the below query focuses on detectability.
|
||||
|
||||
*PsExec detection may have a lot of noise depending on your environment, and may require additional filtering.*
|
||||
|
||||
```
|
||||
(TgtProcCmdLine ContainsCIS "GetTypeFromProgID(" AND TgtProcCmdLine ContainsCIS "MMC20.application" AND TgtProcCmdLine ContainsCIS ".Document.ActiveView.ExecuteShellCommand(") OR (TgtProcName = "wmic.exe" AND TgtProcCmdLine ContainsCIS "/node:" AND TgtProcCmdLine ContainsCIS "process call create") OR ((SrcProcName ContainsCIS "psexec.exe" OR SrcProcDisplayName = "Execute processes remotely") AND DstIp Is Not Empty)
|
||||
```
|
||||
@@ -0,0 +1,270 @@
|
||||
## Persistence
|
||||
|
||||
### T1546.008 Accessibility Features
|
||||
Atomics: [T1546.008](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.008/T1546.008.md)
|
||||
|
||||
Detections addition of a debugger process to executables using Image File Execution Options.
|
||||
|
||||
```
|
||||
(RegistryKeyPath ContainsCIS "CurrentVersion\Image File Execution Options" AND RegistryKeyPath ContainsCIS ".exe\Debugger") AND (EventType = "Registry Value Create" OR EventType = "Registry Key Create")
|
||||
```
|
||||
|
||||
### T1098 Account Manipulation
|
||||
Atomics: [T1098](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098/T1098.md)
|
||||
|
||||
Both Atomic tests for account manipulation rely on PowerShell AD module, so we can catch both with one query. We have the query encapsulated so that we can filter it at the end by Parent Process, as some Logon Scripts and Configuration Items (SCOM, SCCM) may also cause noise. You may want to additionally filter out certain SrcProcUser to reduce noise. What cannot be helped, CommandScript detection on import of Powershell AD cmdlets.
|
||||
|
||||
```
|
||||
( SrcProcCmdLine In Contains Anycase ("New-ADUser","Rename-LocalUser","Set-LocalUser") OR SrcProcCmdScript In Contains Anycase ("New-ADUser","Rename-LocalUser","Set-LocalUser") OR SrcProcCmdLine RegExp "\bAdd-ADGroupMember\b.*\bDomain Admins\b" OR SrcProcCmdScript RegExp "\bAdd-ADGroupMember\b.*\bDomain Admins\b" ) AND SrcProcParentName Not In ("WmiPrvSE.exe","AppVClient.exe","svchost.exe","CompatTelRunner.exe")
|
||||
```
|
||||
|
||||
### T1546.010 Application Shimming
|
||||
Atomics: [T1546.010](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.011/T1546.010.md) ,
|
||||
[T1546.011](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.011/T1546.011.md)
|
||||
|
||||
Detects application shimming through sdbinst or registry modification.
|
||||
|
||||
```
|
||||
(SrcProcName = "sdbinst.exe" and ProcessCmd ContainsCIS ".sdb") OR ((RegistryKeyPath ContainsCIS "AppInit_DLLs" OR RegistryPath ContainsCIS "AppCompatFlags") AND (EventType = "Registry Value Create" OR EventType = "Registry Value Modified"))
|
||||
```
|
||||
|
||||
### T1053.002 AT Scheduled Task
|
||||
Atomics: [T1053.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.002/T1053.002.md)
|
||||
|
||||
Detect interactive process execution scheduled by AT command.
|
||||
|
||||
```
|
||||
TgtProcName = "at.exe" AND TgtProcCmdLine ContainsCIS "/interactive "
|
||||
```
|
||||
|
||||
### T1197 BITS Jobs
|
||||
Atomics: [T1197](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md)
|
||||
|
||||
The below query will find and remote content downloads from DesktopImgDownldr or BitsAdmin processes, Start-BitsTransfer cmdlet downloads, and excludes system processes and noise with SrcProcParentName Not In ().
|
||||
|
||||
```
|
||||
(( TgtProcName In Contains Anycase ("bitsadmin.exe","desktopimgdownldr.exe") AND ( TgtProcCmdLine RegExp "https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)" OR TgtProcCmdLine ContainsCIS "/setnotifycmdline " ) ) OR ( TgtProcName = "powershell.exe" AND TgtProcCmdLine ContainsCIS "Start-BitsTransfer" ) ) AND SrcProcParentName Not In ("services.exe","smss.exe","wininit.exe")
|
||||
```
|
||||
|
||||
### T1176 Browser Extension Installation
|
||||
Atomics: [T1176](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1176/T1176.md)
|
||||
|
||||
This query takes a lazy approach to detecting the staging of xpi or crx extension packages for installation within Chrome and Firefox based browsers. Unsure how to filter our extension updates without excluding too much.
|
||||
|
||||
```
|
||||
( FileFullName RegExp "\bWebstore Downloads\b.*\.(crx)$" OR FileFullName RegExp "\bstaged\b.*\.(xpi)$" ) AND EventType = "File Creation"
|
||||
```
|
||||
|
||||
### T1574.012 COR Profiler
|
||||
Atomics: [T1574.012](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.012/T1574.012.md)
|
||||
|
||||
Detection of unmanaged COR profiler hooking of .NET CLR through registry or process command.
|
||||
|
||||
```
|
||||
(SrcProcCmdScript Contains "COR_" AND SrcProcCmdScript Contains "\Environment") OR RegistryKeyPath Contains "COR_PROFILER_PATH" OR SrcProcCmdScript Contains "$env:COR_"
|
||||
```
|
||||
|
||||
### T1546.001 Change Default File Association
|
||||
Atomics: [1546.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.001/T1546.001.md)
|
||||
|
||||
Detection of file association changes. Detection by registry is noisy due to problem filtering on registry root, so install/uninstall apps create noise.
|
||||
|
||||
```
|
||||
--- File assoc change by registry
|
||||
RegistryKeyPath In Contains Anycase ( "\shell\open\command" , "\shell\print\command" , "\shell\printto\command" ) AND EventType In ( "Registry Value Create" , "Registry Value Modified" )
|
||||
```
|
||||
|
||||
Recommended (for now)
|
||||
```
|
||||
--- File assoc change by assoc command
|
||||
TgtProcCmdLine ContainsCIS "assoc" and TgtProcCmdLine RegExp ".*=.*"
|
||||
```
|
||||
|
||||
### T1574.001 DLL Search Order Hijacking
|
||||
Atomics: [T1574.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.001/T1574.001.md)
|
||||
|
||||
Detection of DLL search order hijack for AMSI bypass. Search order bypasses can target more than AMSI, so this can be expanded upon greatly by switching the `ContainsCIS` to `In Contains Anycase(dll list)`.
|
||||
|
||||
```
|
||||
(FileFullName ContainsCIS "amsi.dll" AND FileFullName Does Not ContainCIS "System32") AND EventType = "File Creation"
|
||||
```
|
||||
|
||||
### T1574.002 DLL Side-Loading of Notepad++ GUP.exe
|
||||
Atomics: [T1574.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md)
|
||||
|
||||
Detection for GUP.exe side-loading a dll, where executable has a display name of "WinGup for Notepad++" and has non-standard source process. Keep an eye on Cross Process events or add `AND EventType = "Open Remote Process Handle"` to the query to narrow down target (child) process.
|
||||
|
||||
```
|
||||
TgtProcDisplayName ContainsCIS "WinGup" and SrcProcName Not In ("notepad++.exe","explorer.exe","lsass.exe","csrss.exe","svchost.exe","WerFault.exe")
|
||||
```
|
||||
|
||||
### T1078.001 Enable Guest account with RDP and Admin
|
||||
Atomics: [T1078.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.001/T1078.001.md)
|
||||
|
||||
Detects enabling of Guest account, adding Guest account to groups, as well as changing of Deny/Allow of Terminal Server connections through Registry changes.
|
||||
|
||||
```
|
||||
(SrcProcCmdLine ContainsCIS "net localgroup" AND SrcProcCmdLine ContainsCIS "guest /add") OR (SrcProcCmdLine ContainsCIS "net user" AND SrcProcCmdLine ContainsCIS "/active:yes") OR (RegistryKeyPath In Contains ("Terminal Server\AllowTSConnections","Terminal Server\DenyTSConnections") AND EventType In ("Registry Value Create","Registry Value Modified"))
|
||||
```
|
||||
|
||||
### T1546.012 Image File Execution Options Injection
|
||||
Atomics: [T1546.012](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.012/T1546.012.md)
|
||||
|
||||
Detection of Image File Execution Options tampering for persistence through Registry monitoring.
|
||||
|
||||
```
|
||||
RegistryKeyPath In Contains Anycase ("CurrentVersion\Image File Execution Options","CurrentVersion\SilentProcessExit") AND RegistryKeyPath In Contains Anycase ("GlobalFlag","ReportingMode","MonitorProcess")
|
||||
```
|
||||
|
||||
### T1136.001 Local Account Added
|
||||
Atomics: [T1136.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1136.001/T1136.001.md)
|
||||
|
||||
In the query below we'll query all instances of local accounts being created for Windows, Linux, and OSX. Depending on your environment, you may find quite a bit of noise with the Linux useradd command.
|
||||
|
||||
```
|
||||
SrcProcCmdLine In Contains Anycase ("net user /add","useradd","New-LocalUser") OR SrcProcCmdLine RegExp "\bdscl\b.*\b/\create\b" OR SrcProcCmdLine RegExp "\bnet localgroup administrators\b.*\b\/add\b"
|
||||
```
|
||||
|
||||
|
||||
### T1037.001 Logon Scripts (Windows)
|
||||
Atomics: [T1037.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.001/T1037.001.md)
|
||||
|
||||
Detects addition of logon scripts through command line or registry methods.
|
||||
|
||||
```
|
||||
SrcProcCmdLine ContainsCIS "UserInitMprLogonScript" OR (RegistryKeyPath ContainsCIS "UserInitMprLogonScript" AND EventType = "Registry Value Create")
|
||||
```
|
||||
|
||||
### T1546.007 Netsh Helper DLL
|
||||
Atomics: [T1546.007](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.007/T1546.007.md)
|
||||
|
||||
Detection of "helper" dlls with network command shell, through command arguments or registry modification.
|
||||
|
||||
```
|
||||
(TgtProcName = "netsh.exe" AND TgtProcCmdLine ContainsCIS "add helper") OR (RegistryPath ContainsCIS "SOFTWARE\Microsoft\NetSh" AND EventType = "Registry Value Create")
|
||||
```
|
||||
|
||||
### T1574.009 Unquoted Service Path for program.exe
|
||||
Atomics: [T1574.009](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.009/T1574.009.md)
|
||||
|
||||
Detects creation or modification of the file at `C:\program.exe` for exploiting unquoted services paths of Program Files folder.
|
||||
|
||||
```
|
||||
(FileFullName = "C:\program.exe" AND EventType In ("File Creation","File Modification")) OR TgtProcImagePath = "C:\program.exe"
|
||||
```
|
||||
|
||||
### T1546.013 Malicious Process Start Added to Powershell Profile
|
||||
Atomics: [T1546.013](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.013/T1546.013.md)
|
||||
|
||||
Detects the addition of process execution strings (`TgtProcCmdLine In Contains Anycase (list)`)to the powershell profile, through CommandLine and CommandScript indicators.
|
||||
|
||||
```
|
||||
(SrcProcCmdScript ContainsCIS "Add-Content $profile -Value" AND SrcProcCmdScript ContainsCIS "Start-Process") OR (TgtProcCmdLine ContainsCIS "Add-Content $profile" AND TgtProcCmdLine In Contains Anycase ("Start-Process","& ","cmd.exe /c"))
|
||||
```
|
||||
|
||||
### T1547.001 Registry Run Keys / Startup Folder
|
||||
Atomics: [T1547.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.001/T1547.001.md)
|
||||
|
||||
**Atomic Tests 1-3, Registry Run Keys**
|
||||
|
||||
Here we're just focusing on the addition of registry keys to Run, RunOnce, RunOnceEx keys where Parent Process isn't "trusted".
|
||||
|
||||
```
|
||||
( RegistryKeyPath ContainsCIS "Windows\CurrentVersion\Run" AND EventType = "Registry Key Create" ) AND SrcProcParentName Not In ("smss.exe","svchost.exe","SetupHost.exe","OneDriveSetup.exe","WindowsUpdateBox.exe")
|
||||
```
|
||||
|
||||
**Atomic Tests 4-6, Startup folder execution**
|
||||
|
||||
With the query below we'll focus on catching any vbs, jse or bat files being written to any Programs\StartUp folder, be that ProgramData or AppData locations.
|
||||
|
||||
```
|
||||
FileFullName ContainsCIS "Programs\Startup" AND FileType In Contains Anycase ("vbs","jse","bat") AND EventType = "File Creation"
|
||||
```
|
||||
|
||||
### T1053.005 Scheduled Tasks
|
||||
Atomics: [T1053.005](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md)
|
||||
|
||||
Our goal with this query is to detect any schtasks /create command as well as any use of the New-ScheduledTask* cmdlets from powershell, and to prevent noise from services and updates we'll exclude a list of system "trusted" SrcProcParentName executables.
|
||||
|
||||
```
|
||||
(( TgtProcName = "schtasks.exe" AND TgtProcCmdLine ContainsCIS "/create" ) OR ( SrcProcCmdLine ContainsCIS "New-ScheduledTask" OR SrcProcCmdScript ContainsCIS "New-ScheduledTask" )) AND SrcProcParentName Not In ("services.exe","OfficeClickToRun.exe")
|
||||
```
|
||||
|
||||
**Optionally, leveraging the ScheduleTaskRegister Indicator object:**
|
||||
|
||||
```
|
||||
IndicatorName = "ScheduleTaskRegister" AND SrcProcParentName Not In ("Integrator.exe","OfficeClickToRun.exe","services.exe","OneDriveSetup.exe","Ccm32BitLauncher.exe","WmiPrvSE.exe")
|
||||
```
|
||||
|
||||
### T1546.002 Screensaver
|
||||
Atomics: [T1546.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.002/T1546.002.md)
|
||||
|
||||
Detects malicious changes to screensaver through Registry changes, filtering expected processes.
|
||||
|
||||
```
|
||||
RegistryKeyPath ContainsCIS "Control Panel\Desktop\SCRNSAVE.EXE" AND (EventType In ("Registry Value Create","Registry Value Modified") AND SrcProcName Not In ("svchost.exe","SetupHost.exe","CcmExec.exe"))
|
||||
```
|
||||
|
||||
### T1547.005 Security Support Provider
|
||||
Atomics: [T1547.005](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.005/T1547.005.md)
|
||||
|
||||
Detection of changes to Security Support Provider through Registry modification. Filters most standard system changes with `SrcProcName Not In (list)` but there will be some noise from installers.
|
||||
|
||||
```
|
||||
RegistryKeyPath ContainsCIS "\Control\Lsa\Security Packages" AND (SrcProcName Not In ("services.exe","SetupHost.exe","svchost.exe") AND SrcProcCmdLine Does Not ContainCIS "system32\wsauth.dll")
|
||||
```
|
||||
|
||||
### T1547.009 Startup Shortcuts
|
||||
Atomics: [T1547.009](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.009/T1547.009.md)
|
||||
|
||||
Focuses on Test 2: Detection .lnk or .url files written to Startup folders. Filters noise with `SrcProcName Not In (list)` but you can remove noise from 3rd party update services updating their links by adding `SrcProcParentName != "userinit.exe"` to the query.
|
||||
|
||||
```
|
||||
(FileFullName ContainsCIS "Microsoft\Windows\Start Menu\Programs\Startup" AND TgtFileExtension In Contains ("lnk","url") AND EventType = "File Creation") AND SrcProcName Not In ("ONENOTE.EXE","msiexec.exe")
|
||||
```
|
||||
|
||||
### T1505.002 Transport Agent
|
||||
Atomics: [T1505.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1505.002/T1505.002.md)
|
||||
|
||||
Detection of Powershell TransportAgent Cmdlets being used to setup an Exchange Transport Agent.
|
||||
|
||||
```
|
||||
SrcProcCmdLine In Contains Anycase ("Install-TransportAgent","Enable-TransportAgent","Get-TransportAgent") OR SrcProcCmdScript In Contains Anycase ("Install-TransportAgent","Enable-TransportAgent","Get-TransportAgent")
|
||||
```
|
||||
|
||||
### T1505.003 Web Shell
|
||||
Atomics: [T1505.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1505.003/T1505.003.md)
|
||||
|
||||
I wanted to get complicated and find any process pulling content from the internet before copying to inetpub but couldn't get that working, so we went generic with our detection and filtered out possibly trusted sources of noise.
|
||||
|
||||
```
|
||||
EventType = "File Creation" AND FileFullName ContainsCIS "inetpub\wwwroot" AND TgtFileExtension In Contains Anycase ("jsp","aspx","php") AND SrcProcName Not In ("explorer.exe","msdeploy.exe")
|
||||
```
|
||||
|
||||
|
||||
### T1546.003 Windows Management Instrumentation Event Subscription
|
||||
Atomics: [T1546.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md)
|
||||
|
||||
Detect WMI Event Subs using the New-CimInstance cmdlet, through CommandLine and CommandScript indicators.
|
||||
|
||||
```
|
||||
SrcProcCmdLine ContainsCIS "New-CimInstance -Namespace root/subscription" OR SrcProcCmdScript ContainsCIS "New-CimInstance -Namespace root/subscription"
|
||||
```
|
||||
|
||||
### T1543.003 Windows Service
|
||||
Atomics: [T1543.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md)
|
||||
|
||||
Detects creation and modification of windows services through binPath argument to sc.exe.
|
||||
|
||||
```
|
||||
TgtProcName = "sc.exe" AND TgtProcCmdLine Contains "binPath="
|
||||
```
|
||||
|
||||
### T1547.004 Winlogon Helper DLL
|
||||
Atomics: [T1547.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.004/T1547.004.md)
|
||||
|
||||
Detects Winlogon Helper Dll changes through Registry MetadataIndicator item, as it holds the full registry change info but will only return data of the Indicators object type.
|
||||
|
||||
```
|
||||
IndicatorMetadata In Contains Anycase ("Microsoft\Windows NT\CurrentVersion\Winlogon","Microsoft\Windows NT\CurrentVersion\Winlogon\Notify") AND IndicatorMetadata In Contains Anycase ("logon","Userinit","Shell") AND IndicatorMetadata Does Not ContainCIS "WINDOWS\system32\userinit.exe"
|
||||
```
|
||||
@@ -0,0 +1,222 @@
|
||||
## Privilege Escalation
|
||||
|
||||
### T1053.002 AT Scheduled Task
|
||||
Atomics: [T1053.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.002/T1053.002.md)
|
||||
|
||||
Detect interactive process execution scheduled by AT command.
|
||||
|
||||
```
|
||||
TgtProcName = "at.exe" AND TgtProcCmdLine ContainsCIS "/interactive "
|
||||
```
|
||||
|
||||
### T1546.008 Accessibility Features
|
||||
Atomics: [T1546.008](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.008/T1546.008.md)
|
||||
|
||||
Detections addition of a debugger process to executables using Image File Execution Options.
|
||||
|
||||
```
|
||||
(RegistryKeyPath ContainsCIS "CurrentVersion\Image File Execution Options" AND RegistryKeyPath ContainsCIS ".exe\Debugger") AND (EventType = "Registry Value Create" OR EventType = "Registry Key Create")
|
||||
```
|
||||
|
||||
### T1546 Application Shimming
|
||||
Atomics: [T1546.010](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.011/T1546.010.md) ,
|
||||
[T1546.011](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.011/T1546.011.md)
|
||||
|
||||
Detects application shimming through sdbinst or registry modification.
|
||||
|
||||
```
|
||||
(SrcProcName = "sdbinst.exe" and ProcessCmd ContainsCIS ".sdb") OR ((RegistryKeyPath ContainsCIS "AppInit_DLLs" OR RegistryPath ContainsCIS "AppCompatFlags") AND (EventType = "Registry Value Create" OR EventType = "Registry Value Modified"))
|
||||
```
|
||||
|
||||
### T1548.002 Bypass User Access Control
|
||||
Atomics: [T1548.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md)
|
||||
|
||||
Detection of UAC bypass through tampering with Shell Open for .ms-settings or .msc file types. Beyond this Atomic test, and to further UAC bypass detection, the below query includes detection for CMSTPLUA COM interface abuse by GUID. See [Security-in-bits](https://www.securityinbits.com/malware-analysis/uac-bypass-analysis-stage-1-ataware-ransomware-part-2/#footnote) for more info about CMSTPLUA COM abuse.
|
||||
|
||||
*Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths were ControlSet001\Service\bam\State\UserSettings\GUID\...*
|
||||
|
||||
```
|
||||
(SrcProcCmdLine ContainsCIS "ms-settings\shell\open\command" OR SrcProcCmdLine ContainsCIS "mscfile\shell\open\command") OR (TgtProcDisplayName = "COM Surrogate" AND TgtProcCmdLine ContainsCIS "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}")
|
||||
```
|
||||
|
||||
### T1574.012 COR Profiler
|
||||
Atomics: [T1574.012](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.012/T1574.012.md)
|
||||
|
||||
Detection of unmanaged COR profiler hooking of .NET CLR through registry or process command.
|
||||
|
||||
```
|
||||
(SrcProcCmdScript Contains "COR_" AND SrcProcCmdScript Contains "\Environment") OR RegistryKeyPath Contains "COR_PROFILER_PATH" OR SrcProcCmdScript Contains "$env:COR_"
|
||||
```
|
||||
|
||||
### T1546.001 Change Default File Association
|
||||
Atomics: [1546.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.001/T1546.001.md)
|
||||
|
||||
Detection of file association changes. Detection by registry is noisy due to problem filtering on registry root, so install/uninstall apps create noise.
|
||||
|
||||
```
|
||||
--- File assoc change by registry
|
||||
RegistryKeyPath In Contains Anycase ( "\shell\open\command" , "\shell\print\command" , "\shell\printto\command" ) AND EventType In ( "Registry Value Create" , "Registry Value Modified" )
|
||||
```
|
||||
|
||||
Recommended (for now)
|
||||
```
|
||||
--- File assoc change by assoc command
|
||||
TgtProcCmdLine ContainsCIS "assoc" and TgtProcCmdLine RegExp ".*=.*"
|
||||
```
|
||||
|
||||
### T1574.001 DLL Search Order Hijacking
|
||||
Atomics: [T1574.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.001/T1574.001.md)
|
||||
|
||||
Detection of DLL search order hijack for AMSI bypass. Search order bypasses can target more than AMSI, so this can be expanded upon greatly by switching the `ContainsCIS` to `In Contains Anycase(dll list)`.
|
||||
|
||||
```
|
||||
(FileFullName ContainsCIS "amsi.dll" AND FileFullName Does Not ContainCIS "System32") AND EventType = "File Creation"
|
||||
```
|
||||
|
||||
### T1574.002 DLL Side-Loading of Notepad++ GUP.exe
|
||||
Atomics: [T1574.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.002/T1574.002.md)
|
||||
|
||||
Detection for GUP.exe side-loading a dll, where executable has a display name of "WinGup for Notepad++" and has non-standard source process. Keep an eye on Cross Process events or add `AND EventType = "Open Remote Process Handle"` to the query to narrow down target (child) process.
|
||||
|
||||
```
|
||||
TgtProcDisplayName ContainsCIS "WinGup" and SrcProcName Not In ("notepad++.exe","explorer.exe","lsass.exe","csrss.exe","svchost.exe","WerFault.exe")
|
||||
```
|
||||
|
||||
### T1078.001 Enable Guest account with RDP and Admin
|
||||
Atomics: [T1078.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.001/T1078.001.md)
|
||||
|
||||
Detects enabling of Guest account, adding Guest account to groups, as well as changing of Deny/Allow of Terminal Server connections through Registry changes.
|
||||
|
||||
```
|
||||
(SrcProcCmdLine ContainsCIS "net localgroup" AND SrcProcCmdLine ContainsCIS "guest /add") OR (SrcProcCmdLine ContainsCIS "net user" AND SrcProcCmdLine ContainsCIS "/active:yes") OR (RegistryKeyPath In Contains ("Terminal Server\AllowTSConnections","Terminal Server\DenyTSConnections") AND EventType In ("Registry Value Create","Registry Value Modified"))
|
||||
```
|
||||
|
||||
### T1546.012 Image File Execution Options Injection
|
||||
Atomics: [T1546.012](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.012/T1546.012.md)
|
||||
|
||||
Detection of Image File Execution Options tampering for persistence through Registry monitoring.
|
||||
|
||||
```
|
||||
RegistryKeyPath In Contains Anycase ("CurrentVersion\Image File Execution Options","CurrentVersion\SilentProcessExit") AND RegistryKeyPath In Contains Anycase ("GlobalFlag","ReportingMode","MonitorProcess")
|
||||
```
|
||||
|
||||
### T1037.001 Logon Scripts (Windows)
|
||||
Atomics: [T1037.001](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.001/T1037.001.md)
|
||||
|
||||
Detects addition of logon scripts through command line or registry methods.
|
||||
|
||||
```
|
||||
SrcProcCmdLine ContainsCIS "UserInitMprLogonScript" OR (RegistryKeyPath ContainsCIS "UserInitMprLogonScript" AND EventType = "Registry Value Create")
|
||||
```
|
||||
|
||||
### T1546.007 Netsh Helper DLL
|
||||
Atomics: [T1546.007](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.007/T1546.007.md)
|
||||
|
||||
Detection of "helper" dlls with network command shell, through command arguments or registry modification.
|
||||
|
||||
```
|
||||
(TgtProcName = "netsh.exe" AND TgtProcCmdLine ContainsCIS "add helper") OR (RegistryPath ContainsCIS "SOFTWARE\Microsoft\NetSh" AND EventType = "Registry Value Create")
|
||||
```
|
||||
|
||||
### T1134.004 Parent PID Spoofing
|
||||
Atomics: [T1134.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.004/T1134.004.md)
|
||||
|
||||
Detects parent PID spoofing through Cross Process indicators (SrcProcParentName limits scope heavily) as well as detecting the use of PPID-Spoof powershell script through Command Scripts indicators. Update the `TgtProcName` list to filter noise.
|
||||
|
||||
```
|
||||
(TgtProcRelation = "not_in_storyline" AND EventType = "Open Remote Process Handle" AND SrcProcParentName In Contains Anycase ("userinit.exe","powershell.exe","cmd.exe") AND TgtProcName != "sihost.exe" And TgtProcIntegrityLevel != "LOW" AND TgtProcName Not In ("SystemSettings.exe")) OR (SrcProcCmdScript ContainsCIS "PPID-Spoof" AND SrcProcCmdScript ContainsCIS "hSpoofParent = [Kernel32]::OpenProcess")
|
||||
```
|
||||
|
||||
### T1574.009 Unquoted Service Path for program.exe
|
||||
Atomics: [T1574.009](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1574.009/T1574.009.md)
|
||||
|
||||
Detects creation or modification of the file at `C:\program.exe` for exploiting unquoted services paths of Program Files folder.
|
||||
|
||||
```
|
||||
(FileFullName = "C:\program.exe" AND EventType In ("File Creation","File Modification")) OR TgtProcImagePath = "C:\program.exe"
|
||||
```
|
||||
|
||||
### T1546.013 Malicious Process Start Added to Powershell Profile
|
||||
Atomics: [T1546.013](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.013/T1546.013.md)
|
||||
|
||||
Detects the addition of process execution strings (`TgtProcCmdLine In Contains Anycase (list)`)to the powershell profile, through CommandLine and CommandScript indicators.
|
||||
|
||||
```
|
||||
(SrcProcCmdScript ContainsCIS "Add-Content $profile -Value" AND SrcProcCmdScript ContainsCIS "Start-Process") OR (TgtProcCmdLine ContainsCIS "Add-Content $profile" AND TgtProcCmdLine In Contains Anycase ("Start-Process","& ","cmd.exe /c"))
|
||||
```
|
||||
|
||||
### T1055.012 Process Hollowing
|
||||
Atomics: [T1055.012](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055.012/T1055.012.md)
|
||||
|
||||
Detect Process Hollowing using the Start-Hollow powershell script, through CommandLine and CommandScript indicators.
|
||||
|
||||
The `IndicatorCategory = "Injection"` has a lot of noise, but in the future a combination of `EventType = "Duplicate Process Handle" AND TgtProcRelation = "storyline_child"` joined with some `ChildProcCount` or `CrossProcCount` > 0 may help filter the noise.
|
||||
|
||||
```
|
||||
--- Detect Start-Hollow.ps1 by command or content
|
||||
(SrcProcCmdScript ContainsCIS "Start-Hollow" AND SrcProcCmdScript ContainsCIS "[Hollow]::NtQueryInformationProcess") OR TgtProcCmdLine ContainsCIS "Start-Hollow"
|
||||
```
|
||||
|
||||
### T1055 Process Injection
|
||||
Atomics: [T1055](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1055/T1055.md)
|
||||
|
||||
Detects Process Injection through execution of MavInject, filtering out noisy/expected activity. `SrcProcParentName` filter narrows Cross Process items to HQ results.
|
||||
|
||||
```
|
||||
(TgtProcName = "mavinject.exe" AND TgtProcCmdLine ContainsCIS "/injectrunning") AND (SrcProcName Not In ("AppVClient.exe") AND SrcProcParentName Not In ("smss.exe"))
|
||||
```
|
||||
|
||||
|
||||
### T1546.002 Screensaver
|
||||
Atomics: [T1546.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.002/T1546.002.md)
|
||||
|
||||
Detects malicious changes to screensaver through Registry changes, filtering expected processes.
|
||||
|
||||
```
|
||||
RegistryKeyPath ContainsCIS "Control Panel\Desktop\SCRNSAVE.EXE" AND (EventType In ("Registry Value Create","Registry Value Modified") AND SrcProcName Not In ("svchost.exe","SetupHost.exe","CcmExec.exe"))
|
||||
```
|
||||
|
||||
### T1547.005 Security Support Provider
|
||||
Atomics: [T1547.005](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.005/T1547.005.md)
|
||||
|
||||
Detection of changes to Security Support Provider through Registry modification. Filters most standard system changes with `SrcProcName Not In (list)` but there will be some noise from installers.
|
||||
|
||||
```
|
||||
RegistryKeyPath ContainsCIS "\Control\Lsa\Security Packages" AND (SrcProcName Not In ("services.exe","SetupHost.exe","svchost.exe") AND SrcProcCmdLine Does Not ContainCIS "system32\wsauth.dll")
|
||||
```
|
||||
|
||||
### T1547.009 Startup Shortcuts
|
||||
Atomics: [T1547.009](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.009/T1547.009.md)
|
||||
|
||||
Focuses on Test 2: Detection .lnk or .url files written to Startup folders. Filters noise with `SrcProcName Not In (list)` but you can remove noise from 3rd party update services updating their links by adding `SrcProcParentName != "userinit.exe"` to the query.
|
||||
|
||||
```
|
||||
(FileFullName ContainsCIS "Microsoft\Windows\Start Menu\Programs\Startup" AND TgtFileExtension In Contains ("lnk","url") AND EventType = "File Creation") AND SrcProcName Not In ("ONENOTE.EXE","msiexec.exe")
|
||||
```
|
||||
|
||||
### T1546.003 Windows Management Instrumentation Event Subscription
|
||||
Atomics: [T1546.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md)
|
||||
|
||||
Detect WMI Event Subs using the New-CimInstance cmdlet, through CommandLine and CommandScript indicators.
|
||||
|
||||
```
|
||||
SrcProcCmdLine ContainsCIS "New-CimInstance -Namespace root/subscription" OR SrcProcCmdScript ContainsCIS "New-CimInstance -Namespace root/subscription"
|
||||
```
|
||||
|
||||
### T1543.003 Windows Service
|
||||
Atomics: [T1543.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md)
|
||||
|
||||
Detects creation and modification of windows services through binPath argument to sc.exe.
|
||||
|
||||
```
|
||||
TgtProcName = "sc.exe" AND TgtProcCmdLine Contains "binPath="
|
||||
```
|
||||
|
||||
### T1547.004 Winlogon Helper DLL
|
||||
Atomics: [T1547.004](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.004/T1547.004.md)
|
||||
|
||||
Detects Winlogon Helper Dll changes through Registry MetadataIndicator item, as it holds the full registry change info but will only return data of the Indicators object type.
|
||||
|
||||
```
|
||||
IndicatorMetadata In Contains Anycase ("Microsoft\Windows NT\CurrentVersion\Winlogon","Microsoft\Windows NT\CurrentVersion\Winlogon\Notify") AND IndicatorMetadata In Contains Anycase ("logon","Userinit","Shell") AND IndicatorMetadata Does Not ContainCIS "WINDOWS\system32\userinit.exe"
|
||||
```
|
||||
Reference in New Issue
Block a user