Summary: {{ tactic.tactic_description }}
8 | 9 | {% endblock %} 10 | 11 | -------------------------------------------------------------------------------- /elemental/matrix/templates/matrix/addSigma.html: -------------------------------------------------------------------------------- 1 | {% extends "base_generic.html" %} 2 | 3 | 4 | {% load short_name %} 5 | 6 | {% block title %}There are no Tactics.
15 | {% endif %} 16 | {% endblock %} -------------------------------------------------------------------------------- /elemental/media/atomics/T1214.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | attack_technique: T1214 3 | display_name: Credentials in Registry 4 | 5 | atomic_tests: 6 | - name: Enumeration for Credentials in Registry 7 | description: | 8 | Queries to enumerate for credentials in the Registry. 9 | 10 | supported_platforms: 11 | - windows 12 | 13 | executor: 14 | name: command_prompt 15 | elevation_required: false 16 | command: | 17 | reg query HKLM /f password /t REG_SZ /s 18 | reg query HKCU /f password /t REG_SZ /s 19 | -------------------------------------------------------------------------------- /elemental/media/atomics/T1151.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | attack_technique: T1151 3 | display_name: Space After Filename 4 | 5 | atomic_tests: 6 | - name: Space After Filename 7 | description: | 8 | Space After Filename 9 | 10 | supported_platforms: 11 | - macos 12 | 13 | executor: 14 | name: manual 15 | steps: | 16 | 1. echo '#!/bin/bash\necho "print \"hello, world!\"" | /usr/bin/python\nexit' > execute.txt && chmod +x execute.txt 17 | 18 | 2. mv execute.txt "execute.txt " 19 | 20 | 3. ./execute.txt\ 21 | -------------------------------------------------------------------------------- /elemental/matrix/templates/matrix/note_detail.html: -------------------------------------------------------------------------------- 1 | {% extends "base_generic_no_header.html" %} 2 | 3 | {% block content %} 4 | 5 |{{note.date}}
7 | 8 |{{ note | safe }}An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.4 | 5 | ## Atomic Tests 6 | 7 | - [Atomic Test #1 - Data Transfer Size Limits](#atomic-test-1---data-transfer-size-limits) 8 | 9 | 10 |
| 10 | {% for tactic in total_tactics %} 11 | {{ tactic.tactic_name }} 12 | {% for tech in techfortactics %} 13 | {{ tech.technique_id }} 14 | {% endfor %} 15 | | 16 |17 | {% endfor %} 18 | 19 | |
There are no Tactics for this mother.
24 | {% endif %} 25 | {% endblock %} -------------------------------------------------------------------------------- /elemental/media/sigma_rules/win_atsvc_task.yml: -------------------------------------------------------------------------------- 1 | title: Remote Task Creation via ATSVC named pipe 2 | id: f6de6525-4509-495a-8a82-1f8b0ed73a00 3 | description: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe 4 | author: Samir Bousseaden 5 | references: 6 | - https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html 7 | tags: 8 | - attack.lateral_movement 9 | - attack.persistence 10 | - attack.t1053 11 | - car.2013-05-004 12 | - car.2015-04-001 13 | logsource: 14 | product: windows 15 | service: security 16 | description: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure' 17 | detection: 18 | selection: 19 | EventID: 5145 20 | ShareName: \\*\IPC$ 21 | RelativeTargetName: atsvc 22 | Accesses: '*WriteData*' 23 | condition: selection 24 | falsepositives: 25 | - pentesting 26 | level: medium 27 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/win_overpass_the_hash.yml: -------------------------------------------------------------------------------- 1 | title: Successful Overpass the Hash Attempt 2 | id: 192a0330-c20b-4356-90b6-7b7049ae0b87 3 | status: experimental 4 | description: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module. 5 | references: 6 | - https://cyberwardog.blogspot.de/2017/04/chronicles-of-threat-hunter-hunting-for.html 7 | author: Roberto Rodriguez (source), Dominik Schaudel (rule) 8 | date: 2018/02/12 9 | tags: 10 | - attack.lateral_movement 11 | - attack.t1075 12 | - attack.s0002 13 | logsource: 14 | product: windows 15 | service: security 16 | detection: 17 | selection: 18 | EventID: 4624 19 | LogonType: 9 20 | LogonProcessName: seclogo 21 | AuthenticationPackageName: Negotiate 22 | condition: selection 23 | falsepositives: 24 | - Runas command-line tool using /netonly parameter 25 | level: high 26 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/sysmon_registry_persistence_key_linking.yml: -------------------------------------------------------------------------------- 1 | title: Windows Registry Persistence - COM key linking 2 | id: 9b0f8a61-91b2-464f-aceb-0527e0a45020 3 | status: experimental 4 | description: Detects COM object hijacking via TreatAs subkey 5 | references: 6 | - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ 7 | author: Kutepov Anton, oscd.community 8 | date: 2019/10/23 9 | modified: 2019/11/07 10 | tags: 11 | - attack.persistence 12 | - attack.t1122 13 | logsource: 14 | product: windows 15 | service: sysmon 16 | detection: 17 | selection: 18 | EventID: 12 19 | TargetObject|startswith: 'HKU\' 20 | TargetObject|contains: '_Classes\CLSID\' 21 | TargetObject|endswith: '\TreatAs' 22 | condition: selection 23 | falsepositives: 24 | - Maybe some system utilities in rare cases use linking keys for backward compability 25 | level: medium 26 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/web_cve_2018_2894_weblogic_exploit.yml: -------------------------------------------------------------------------------- 1 | title: Oracle WebLogic Exploit 2 | id: 37e8369b-43bb-4bf8-83b6-6dd43bda2000 3 | description: Detects access to a webshell droped into a keytore folder on the WebLogic server 4 | author: Florian Roth 5 | date: 2018/07/22 6 | status: experimental 7 | references: 8 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2894 9 | - https://twitter.com/pyn3rd/status/1020620932967223296 10 | - https://github.com/LandGrey/CVE-2018-2894 11 | logsource: 12 | category: webserver 13 | detection: 14 | selection: 15 | c-uri-path: 16 | - '*/config/keystore/*.js*' 17 | condition: selection 18 | fields: 19 | - c-ip 20 | - c-dns 21 | falsepositives: 22 | - Unknown 23 | tags: 24 | - attack.t1100 25 | - attack.t1190 26 | - attack.initial_access 27 | - attack.persistence 28 | - attack.privilege_escalation 29 | - cve.2018-2894 30 | level: critical 31 | 32 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/win_powershell_dll_execution.yml: -------------------------------------------------------------------------------- 1 | title: Detection of PowerShell Execution via DLL 2 | id: 6812a10b-60ea-420c-832f-dfcc33b646ba 3 | status: experimental 4 | description: Detects PowerShell Strings applied to rundllas seen in PowerShdll.dll 5 | references: 6 | - https://github.com/p3nt4/PowerShdll/blob/master/README.md 7 | tags: 8 | - attack.execution 9 | - attack.t1086 10 | - car.2014-04-003 11 | author: Markus Neis 12 | date: 2018/08/25 13 | logsource: 14 | category: process_creation 15 | product: windows 16 | detection: 17 | selection1: 18 | Image: 19 | - '*\rundll32.exe' 20 | selection2: 21 | Description: 22 | - '*Windows-Hostprozess (Rundll32)*' 23 | selection3: 24 | CommandLine: 25 | - '*Default.GetString*' 26 | - '*FromBase64String*' 27 | condition: (selection1 or selection2) and selection3 28 | falsepositives: 29 | - Unknown 30 | level: high 31 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/win_susp_devtoolslauncher.yml: -------------------------------------------------------------------------------- 1 | title: Devtoolslauncher.exe executes specified binary 2 | id: cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6 3 | status: experimental 4 | description: The Devtoolslauncher.exe executes other binary 5 | references: 6 | - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Devtoolslauncher.yml 7 | - https://twitter.com/_felamos/status/1179811992841797632 8 | author: Beyu Denis, oscd.community (rule), @_felamos (idea) 9 | date: 2019/10/12 10 | modified: 2019/11/04 11 | tags: 12 | - attack.defense_evasion 13 | - attack.execution 14 | - attack.t1218 15 | level: critical 16 | logsource: 17 | category: process_creation 18 | product: windows 19 | detection: 20 | selection: 21 | Image|endswith: '\devtoolslauncher.exe' 22 | CommandLine|contains: 'LaunchForDeploy' 23 | condition: selection 24 | falsepositives: 25 | - Legitimate use of devtoolslauncher.exe by legitimate user 26 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/win_hack_rubeus.yml: -------------------------------------------------------------------------------- 1 | title: Rubeus Hack Tool 2 | id: 7ec2c172-dceb-4c10-92c9-87c1881b7e18 3 | description: Detects command line parameters used by Rubeus hack tool 4 | author: Florian Roth 5 | references: 6 | - https://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ 7 | date: 2018/12/19 8 | tags: 9 | - attack.credential_access 10 | - attack.t1003 11 | - attack.s0005 12 | logsource: 13 | category: process_creation 14 | product: windows 15 | detection: 16 | selection: 17 | CommandLine: 18 | - '* asreproast *' 19 | - '* dump /service:krbtgt *' 20 | - '* kerberoast *' 21 | - '* createnetonly /program:*' 22 | - '* ptt /ticket:*' 23 | - '* /impersonateuser:*' 24 | - '* renew /ticket:*' 25 | - '* asktgt /user:*' 26 | - '* harvest /interval:*' 27 | condition: selection 28 | falsepositives: 29 | - unlikely 30 | level: critical 31 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/apt_babyshark.yml: -------------------------------------------------------------------------------- 1 | title: Baby Shark Activity 2 | id: 2b30fa36-3a18-402f-a22d-bf4ce2189f35 3 | status: experimental 4 | description: Detects activity that could be related to Baby Shark malware 5 | references: 6 | - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/ 7 | tags: 8 | - attack.execution 9 | - attack.t1059 10 | - attack.t1086 11 | - attack.discovery 12 | - attack.t1012 13 | - attack.defense_evasion 14 | - attack.t1170 15 | logsource: 16 | category: process_creation 17 | product: windows 18 | author: Florian Roth 19 | date: 2019/02/24 20 | detection: 21 | selection: 22 | CommandLine: 23 | - reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" 24 | - powershell.exe mshta.exe http* 25 | - cmd.exe /c taskkill /im cmd.exe 26 | condition: selection 27 | falsepositives: 28 | - unknown 29 | level: high 30 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/win_susp_rundll32_by_ordinal.yml: -------------------------------------------------------------------------------- 1 | title: Suspicious Call by Ordinal 2 | id: e79a9e79-eb72-4e78-a628-0e7e8f59e89c 3 | description: Detects suspicious calls of DLLs in rundll32.dll exports by ordinal 4 | status: experimental 5 | references: 6 | - https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/ 7 | - https://github.com/Neo23x0/DLLRunner 8 | - https://twitter.com/cyb3rops/status/1186631731543236608 9 | tags: 10 | - attack.defense_evasion 11 | - attack.execution 12 | - attack.t1085 13 | author: Florian Roth 14 | date: 2019/10/22 15 | logsource: 16 | category: process_creation 17 | product: windows 18 | detection: 19 | selection: 20 | CommandLine: '*\rundll32.exe *,#*' 21 | condition: selection 22 | falsepositives: 23 | - False positives depend on scripts and administrative tools used in the monitored environment 24 | - Windows contol panel elements have been identified as source (mmc) 25 | level: high 26 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/proxy_raw_paste_service_access.yml: -------------------------------------------------------------------------------- 1 | title: Raw Paste Service Access 2 | id: 5468045b-4fcc-4d1a-973c-c9c9578edacb 3 | status: experimental 4 | description: Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form 5 | references: 6 | - https://www.virustotal.com/gui/domain/paste.ee/relations 7 | author: Florian Roth 8 | date: 2019/12/05 9 | tags: 10 | - attack.t1102 11 | - attack.defense_evasion 12 | logsource: 13 | category: proxy 14 | detection: 15 | selection: 16 | c-uri|contains: 17 | - '.paste.ee/r/' 18 | - '.pastebin.com/raw/' 19 | - '.hastebin.com/raw/' 20 | condition: selection 21 | fields: 22 | - ClientIP 23 | - c-uri 24 | - c-useragent 25 | falsepositives: 26 | - User activity (e.g. developer that shared and copied code snippets and used the raw link instead of just copy & paste) 27 | level: high 28 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/sysmon_susp_download_run_key.yml: -------------------------------------------------------------------------------- 1 | title: Suspicious RUN Key from Download 2 | id: 9c5037d1-c568-49b3-88c7-9846a5bdc2be 3 | status: experimental 4 | description: Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories 5 | references: 6 | - https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/ 7 | author: Florian Roth 8 | date: 2019/10/01 9 | tags: 10 | - attack.persistence 11 | - attack.t1060 12 | logsource: 13 | product: windows 14 | service: sysmon 15 | detection: 16 | selection: 17 | EventID: 13 18 | Image: 19 | - '*\Downloads\\*' 20 | - '*\Temporary Internet Files\Content.Outlook\\*' 21 | - '*\Local Settings\Temporary Internet Files\\*' 22 | TargetObject: '*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\*' 23 | condition: selection 24 | falsepositives: 25 | - Software installers downloaded and used by users 26 | level: high -------------------------------------------------------------------------------- /elemental/media/sigma_rules/powershell_suspicious_invocation_specific.yml: -------------------------------------------------------------------------------- 1 | title: Suspicious PowerShell Invocations - Specific 2 | id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c 3 | status: experimental 4 | description: Detects suspicious PowerShell invocation command parameters 5 | tags: 6 | - attack.execution 7 | - attack.t1086 8 | author: Florian Roth (rule) 9 | logsource: 10 | product: windows 11 | service: powershell 12 | detection: 13 | keywords: 14 | Message: 15 | - '* -nop -w hidden -c * [Convert]::FromBase64String*' 16 | - '* -w hidden -noni -nop -c "iex(New-Object*' 17 | - '* -w hidden -ep bypass -Enc*' 18 | - '*powershell.exe reg add HKCU\software\microsoft\windows\currentversion\run*' 19 | - '*bypass -noprofile -windowstyle hidden (new-object system.net.webclient).download*' 20 | - '*iex(New-Object Net.WebClient).Download*' 21 | condition: keywords 22 | falsepositives: 23 | - Penetration tests 24 | level: high 25 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/sysmon_win_binary_susp_com.yml: -------------------------------------------------------------------------------- 1 | title: Microsoft Binary Suspicious Communication Endpoint 2 | id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 3 | status: experimental 4 | description: Detects an executable in the Windows folder accessing suspicious domains 5 | references: 6 | - https://twitter.com/M_haggis/status/900741347035889665 7 | - https://twitter.com/M_haggis/status/1032799638213066752 8 | author: Florian Roth 9 | date: 2018/08/30 10 | tags: 11 | - attack.lateral_movement 12 | - attack.t1105 13 | logsource: 14 | product: windows 15 | service: sysmon 16 | detection: 17 | selection: 18 | EventID: 3 19 | Initiated: 'true' 20 | DestinationHostname: 21 | - '*dl.dropboxusercontent.com' 22 | - '*.pastebin.com' 23 | - '*.githubusercontent.com' # includes both gists and github repositories 24 | Image: 'C:\Windows\\*' 25 | condition: selection 26 | falsepositives: 27 | - 'Unknown' 28 | level: high 29 | 30 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/win_exploit_cve_2017_11882.yml: -------------------------------------------------------------------------------- 1 | title: Droppers exploiting CVE-2017-11882 2 | id: 678eb5f4-8597-4be6-8be7-905e4234b53a 3 | status: experimental 4 | description: Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe 5 | references: 6 | - https://www.hybrid-analysis.com/sample/2a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b7507?environmentId=100 7 | - https://www.google.com/url?hl=en&q=https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about&source=gmail&ust=1511481120837000&usg=AFQjCNGdL7gVwLXaNSl2Td8ylDYbSJFmPw 8 | author: Florian Roth 9 | date: 2017/11/23 10 | tags: 11 | - attack.defense_evasion 12 | - attack.t1211 13 | logsource: 14 | category: process_creation 15 | product: windows 16 | detection: 17 | selection: 18 | ParentImage: '*\EQNEDT32.EXE' 19 | condition: selection 20 | fields: 21 | - CommandLine 22 | falsepositives: 23 | - unknown 24 | level: critical 25 | -------------------------------------------------------------------------------- /elemental/media/sigma_rules/win_susp_msoffice.yml: -------------------------------------------------------------------------------- 1 | title: Malicious payload download via Office binaries 2 | id: 0c79148b-118e-472b-bdb7-9b57b444cc19 3 | status: experimental 4 | description: Downloads payload from remote server 5 | references: 6 | - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Powerpnt.yml 7 | - https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191 8 | - Reegun J (OCBC Bank) 9 | author: Beyu Denis, oscd.community 10 | date: 2019/10/26 11 | modified: 2019/11/04 12 | tags: 13 | - attack.command_and_control 14 | - attack.t1105 15 | level: high 16 | logsource: 17 | category: process_creation 18 | product: windows 19 | detection: 20 | selection: 21 | Image|endswith: 22 | - '\powerpnt.exe' 23 | - '\winword.exe' 24 | - '\excel.exe' 25 | CommandLine|contains: 'http' 26 | condition: selection 27 | falsepositives: 28 | - Unknown 29 | -------------------------------------------------------------------------------- /elemental/media/atomics/T1160.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | attack_technique: T1160 3 | display_name: Launch Daemon 4 | 5 | atomic_tests: 6 | - name: Launch Daemon 7 | description: | 8 | Utilize LaunchDaemon to launch `Hello World` 9 | 10 | supported_platforms: 11 | - macos 12 | 13 | 14 | executor: 15 | name: manual 16 | steps: | 17 | 1. Place the following file (com.example.hello) in /System/Library/LaunchDaemons or /Library/LaunchDaemons 18 | 2. 19 | 20 | 21 |