Merge pull request SigmaHQ#679 from Iveco/master

add LDAPFragger detections

rules/windows/builtin/win_susp_ldap_dataexchange.yml

@@ -0,0 +1,28 @@
+title: Suspicious LDAP-Attributes Used
+id: d00a9a72-2c09-4459-ad03-5e0a23351e36
+description: detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.
+status: experimental
+date: 2019/03/24
+author: xknow @xknow_infosec
+references:
+    - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
+    - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
+    - https://github.com/fox-it/LDAPFragger
+tags:
+    - attack.t1041
+    - attack.persistence
+logsource:
+    product: windows
+    service: security
+detection:
+    selection:
+        EventID: 5136
+        AttributeValue: '*'
+        AttributeLDAPDisplayName:
+            - 'primaryInternationalISDNNumber'
+            - 'otherFacsimileTelephoneNumber'
+            - 'primaryTelexNumber'
+    condition: selection
+falsepositives:
+    - Companies, who may use these default LDAP-Attributes for personal information
+level: high

rules/windows/sysmon/sysmon_susp_adsi_cache_usage.yml

@@ -0,0 +1,30 @@
+title: Suspicious ADSI-Cache Usage By Unknown Tool
+id: 75bf09fa-1dd7-4d18-9af9-dd9e492562eb
+description: detects the usage of ADSI (LDAP) operations by tools. This may also detect tools like LDAPFragger.
+status: experimental
+date: 2019/03/24
+author: xknow @xknow_infosec
+references:
+    - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
+    - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
+    - https://github.com/fox-it/LDAPFragger
+tags:
+    - attack.t1041
+    - attack.persistence
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selection_1:
+        EventID: 11
+        TargetFilename: '*\Local\Microsoft\Windows\SchCache\*.sch'
+    selection_2:
+        Image|contains:
+            - 'C:\windows\system32\svchost.exe'
+            - 'C:\windows\system32\dllhost.exe'
+            - 'C:\windows\system32\mmc.exe'
+            - 'C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe'
+    condition: selection_1 and not selection_2
+falsepositives:
+    - Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc.
+level: high