Merge remote-tracking branch 'upstream/master'

lukiffer · Jul 21, 2020 · 83623f3 · 83623f3
2 parents da30266 + 71aa8ad
commit 83623f3
Show file tree

Hide file tree

Showing 22 changed files with 27 additions and 13 deletions.
diff --git a/rules/cloud/aws_cloudtrail_disable_logging.yml b/rules/cloud/aws_cloudtrail_disable_logging.yml
@@ -21,5 +21,6 @@ level: medium
 falsepositives:
     - Valid change in a Trail
 tags:
+    - attack.defense_evasion
     - attack.t1089
     - attack.t1562.001
diff --git a/rules/cloud/aws_config_disable_recording.yml b/rules/cloud/aws_config_disable_recording.yml
@@ -18,5 +18,6 @@ level: high
 falsepositives:
     - Valid change in AWS Config Service
 tags:
+    - attack.defense_evasion
     - attack.t1089
     - attack.t1562.001
diff --git a/rules/cloud/aws_guardduty_disruption.yml b/rules/cloud/aws_guardduty_disruption.yml
@@ -18,5 +18,6 @@ level: high
 falsepositives:
     - Valid change in the GuardDuty (e.g. to ignore internal scanners)
 tags:
+    - attack.defense_evasion
     - attack.t1089
     - attack.t1562.001
diff --git a/rules/windows/builtin/win_not_allowed_rdp_access.yml b/rules/windows/builtin/win_not_allowed_rdp_access.yml
@@ -6,6 +6,7 @@ status: experimental
 tags:
     - attack.lateral_movement
     - attack.t1076
+    - attack.t1021.001
 references:
     - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
 author: Pushkarev Dmitry

diff --git a/rules/windows/builtin/win_rdp_localhost_login.yml b/rules/windows/builtin/win_rdp_localhost_login.yml
@@ -9,7 +9,7 @@ tags:
     - attack.lateral_movement
     - attack.t1076
     - car.2013-07-002
-    - attack.t1021
+    - attack.t1021.001
 status: experimental
 author: Thomas Patzke
 logsource:

diff --git a/rules/windows/file_event/sysmon_powershell_exploit_scripts.yml b/rules/windows/file_event/sysmon_powershell_exploit_scripts.yml
@@ -7,6 +7,7 @@ references:
 tags:
     - attack.execution
     - attack.t1086
+    - attack.t1059.001
 author: Markus Neis
 date: 2018/04/07
 logsource:

diff --git a/rules/windows/file_event/sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml b/rules/windows/file_event/sysmon_susp_procexplorer_driver_created_in_tmp_folder.yml
@@ -8,6 +8,7 @@ references:
     - https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
 tags:
     - attack.t1089
+    - attack.t1562.001
     - attack.defense_evasion
 logsource:
     product: windows

diff --git a/rules/windows/image_load/sysmon_in_memory_powershell.yml b/rules/windows/image_load/sysmon_in_memory_powershell.yml
@@ -10,6 +10,7 @@ references:
     - https://github.com/p3nt4/PowerShdll
 tags:
     - attack.t1086
+    - attack.t1059.001
     - attack.execution
 logsource:
     category: image_load

diff --git a/rules/windows/image_load/sysmon_powershell_execution_moduleload.yml b/rules/windows/image_load/sysmon_powershell_execution_moduleload.yml
@@ -13,6 +13,7 @@ logsource:
 tags:
     - attack.execution
     - attack.t1086
+    - attack.t1059.001
 detection:
     selection: 
         Description: 'system.management.automation'

diff --git a/rules/windows/network_connection/sysmon_powershell_network_connection.yml b/rules/windows/network_connection/sysmon_powershell_network_connection.yml
@@ -10,6 +10,7 @@ references:
 tags:
     - attack.execution
     - attack.t1086
+    - attack.t1059.001
 logsource:
     category: network_connection
     product: windows

diff --git a/rules/windows/network_connection/sysmon_remote_powershell_session_network.yml b/rules/windows/network_connection/sysmon_remote_powershell_session_network.yml
@@ -9,6 +9,7 @@ references:
 tags:
     - attack.execution
     - attack.t1086
+    - attack.t1059.001
 logsource:
     category: network_connection
     product: windows

diff --git a/rules/windows/other/win_defender_disabled.yml b/rules/windows/other/win_defender_disabled.yml
@@ -20,7 +20,13 @@ detection:
             - 5010
             - 5012
             - 5101
-    condition: selection
+    selection2:
+        TargetObject:
+            - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
+            - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
+            - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
+        Details: 'DWORD (0x00000001)'
+    condition: 1 of them
 falsepositives:
     - Administrator actions
 level: high
diff --git a/rules/windows/process_access/sysmon_invoke_phantom.yml b/rules/windows/process_access/sysmon_invoke_phantom.yml
@@ -9,6 +9,7 @@ references:
     - https://twitter.com/timbmsft/status/900724491076214784
 tags:
     - attack.t1089
+    - attck.t1562.001
     - attack.defense_evasion
 logsource:
     category: process_access

diff --git a/rules/windows/process_creation/win_apt_empiremonkey.yml b/rules/windows/process_creation/win_apt_empiremonkey.yml
@@ -6,6 +6,7 @@ references:
     - https://app.any.run/tasks/a4107649-8cb0-41af-ad75-113152d4d57b
 tags:
     - attack.t1086
+    - attack.t1059.001
     - attack.execution
 date: 2019/04/02
 author: Markus Neis

diff --git a/rules/windows/process_creation/win_apt_ke3chang_regadd.yml b/rules/windows/process_creation/win_apt_ke3chang_regadd.yml
@@ -9,6 +9,7 @@ tags:
     - attack.g0004
     - attack.t1059
     - attack.t1089
+    - attack.t1562.001
 author: Markus Neis, Swisscom 
 date: 2020/06/18
 logsource:

diff --git a/rules/windows/process_creation/win_susp_disable_ie_features.yml b/rules/windows/process_creation/win_susp_disable_ie_features.yml
@@ -5,7 +5,9 @@ description: Detects command lines that indicate unwanted modifications to regis
 references:
     - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
 tags:
+    - attack.defense_evasion
     - attack.t1089
+    - attack.t1562.001
 author: Florian Roth 
 date: 2020/06/19
 logsource:

diff --git a/rules/windows/process_creation/win_susp_powershell_parent_process.yml b/rules/windows/process_creation/win_susp_powershell_parent_process.yml
@@ -9,6 +9,7 @@ date: 2020/03/20
 tags:
     - attack.execution
     - attack.t1086
+    - attack.t1059.001
 logsource:
     category: process_creation
     product: windows

diff --git a/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml b/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml
@@ -10,7 +10,7 @@ tags:
     - attack.privilege_escalation
     - attack.t1076
     - car.2013-07-002
-    - attack.t1021
+    - attack.t1021.001
 author: Florian Roth
 date: 2018/03/17
 modified: 2018/12/11

diff --git a/...s/windows/registry_event/sysmon_disable_security_events_logging_adding_reg_key_minint.yml b/...s/windows/registry_event/sysmon_disable_security_events_logging_adding_reg_key_minint.yml
@@ -7,6 +7,7 @@ references:
 tags:
     - attack.defense_evasion
     - attack.t1089
+    - attack.t1562.001
 author: Ilyas Ochkov, oscd.community
 date: 2019/10/25
 modified: 2019/11/13

diff --git a/rules/windows/registry_event/sysmon_susp_service_installed.yml b/rules/windows/registry_event/sysmon_susp_service_installed.yml
@@ -8,6 +8,7 @@ references:
     - https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
 tags:
     - attack.t1089
+    - attack.t1562.001
     - attack.defense_evasion
 logsource:
     category: registry_event

diff --git a/tools/config/winlogbeat-modules-enabled.yml b/tools/config/winlogbeat-modules-enabled.yml
@@ -29,11 +29,6 @@ logsources:
     service: sysmon
     conditions:
       winlog.channel: 'Microsoft-Windows-Sysmon/Operational'
-  windows-process-creation:
-    product: windows
-    category: process_creation
-    conditions:
-      winlog.event_id: '1'
   windows-dns-server:
     product: windows
     service: dns-server

diff --git a/tools/config/winlogbeat.yml b/tools/config/winlogbeat.yml
@@ -28,11 +28,6 @@ logsources:
     service: sysmon
     conditions:
       winlog.channel: 'Microsoft-Windows-Sysmon/Operational'
-  windows-process-creation:
-    product: windows
-    category: process_creation
-    conditions:
-      winlog.event_id: '1'
   windows-dns-server:
     product: windows
     service: dns-server