Skip to content

Commit 3076c9e

Browse files
rabbitstackrabbitstack
authored
feat (rules): Stateful detection rules (#123)
* stateful event tracking with sequences initial work * implement pattern bindings and refine fsm handling * refactoring, fix deadline handling * sequence rule evaluation optimizations * retraction logic and sequence state tests * sequence expiration, polishing and refactoring. Expand sequence state tests to cover sequence expiration * More testing and polishing * refactoring, polishing, and more testing * expire both CreateEvents and any other event originated from the same pid, example of stateful detection * boost `not` operator matching, fix lint warnings, polish example sequence rule
1 parent fff7d43 commit 3076c9e

29 files changed

+1493
-207
lines changed

‎configs/rules/default/default.yml‎

Lines changed: 41 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -22,17 +22,17 @@
2222
enabled: true
2323
policy: exclude
2424
relation: or
25-
from-strings:
25+
rules:
2626
- name: Windows error reporting/telemetry, WMI provider host
27-
def: ps.comm istartswith
27+
condition: ps.comm istartswith
2828
(
2929
' \"C:\\Windows\\system32\\wermgr.exe\\" \"-queuereporting_svc\" ',
3030
'C:\\Windows\\system32\\DllHost.exe /Processid',
3131
'C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding',
3232
'C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding'
3333
)
3434
- name: Windows error reporting/telemetry, Search Indexer, Session Manager, Auto check utility
35-
def: ps.comm iin
35+
condition: ps.comm iin
3636
(
3737
'C:\\Windows\\system32\\wermgr.exe -upload',
3838
'C:\\Windows\\system32\\SearchIndexer.exe /Embedding',
@@ -42,7 +42,7 @@
4242
'C:\\Windows\\System32\\RuntimeBroker.exe -Embedding'
4343
)
4444
- name: Various Windows processes
45-
def: ps.exe iin
45+
condition: ps.exe iin
4646
(
4747
'C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\TabTip32.exe',
4848
'C:\\Windows\\System32\\TokenBrokerCookies.exe',
@@ -68,11 +68,11 @@
6868
'C:\\Windows\\System32\\usocoreworker.exe -Embedding'
6969
)
7070
- name: svchost
71-
def: ps.comm iin {{ .Values.processes.comm.svchost | stringify }}
71+
condition: ps.comm iin {{ .Values.processes.comm.svchost | stringify }}
7272
- name: Microsoft edge
73-
def: ps.comm istartswith '\"C:\\Program Files (x86)\\Microsoft\\Edge Dev\\Application\\msedge.exe\" --type='
73+
condition: ps.comm istartswith '\"C:\\Program Files (x86)\\Microsoft\\Edge Dev\\Application\\msedge.exe\" --type='
7474
- name: Microsoft dotNet
75-
def: ps.comm istartswith
75+
condition: ps.comm istartswith
7676
(
7777
'C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe',
7878
'C:\\WINDOWS\\Microsoft.NET\\Framework64\\v4.0.30319\\Ngen.exe'
@@ -85,7 +85,7 @@
8585
'C:\\Windows\\Microsoft.Net\\Framework64\\*\\WPF\\PresentationFontCache.exe'
8686
)
8787
- name: Microsoft Office
88-
def: ps.exe iin
88+
condition: ps.exe iin
8989
(
9090
'C:\\Program Files\\Microsoft Office\\Office16\\MSOSYNC.EXE',
9191
'C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSOSYNC.EXE',
@@ -95,9 +95,9 @@
9595
'C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe'
9696
)
9797
- name: Media Player
98-
def: ps.exe = 'C:\\Program Files\\Windows Media Player\\wmpnscfg.exe'
98+
condition: ps.exe = 'C:\\Program Files\\Windows Media Player\\wmpnscfg.exe'
9999
- name: Google
100-
def: ps.comm istartswith
100+
condition: ps.comm istartswith
101101
(
102102
'\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\\\" --type=',
103103
'\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type='
@@ -108,12 +108,10 @@
108108
- group: Suspicious process terminations
109109
selector:
110110
type: TerminateProcess
111-
enabled: true
112111
policy: include
113-
relation: or
114-
from-strings:
112+
rules:
115113
- name: User binaries
116-
def: ps.name istartswith ('C:\\Users', '\\')
114+
condition: ps.name istartswith ('C:\\Users', '\\')
117115

118116

119117
# ======================= Remote thread creation =====================================================
@@ -124,12 +122,10 @@
124122
- group: Suspicious remote thread creations
125123
selector:
126124
type: CreateThread
127-
enabled: true
128125
policy: include
129-
relation: or
130-
from-strings:
126+
rules:
131127
- name: Fishy remote threads
132-
def: kevt.pid != thread.pid
128+
condition: kevt.pid != thread.pid
133129
and
134130
ps.exe not iin
135131
(
@@ -143,10 +139,11 @@
143139
'C:\\Windows\\system32\\kernel32.dll',
144140
'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'
145141
)
146-
action: |
147-
{{ $title := cat "Identified remote thread creation in" .Kevt.Kparams.exe }}
148-
{{ $text := cat "Injected by" .Kevt.PS.Exe }}
149-
{{ emit $title $text }}
142+
action: >
143+
{{ emit
144+
(printf "Detected remote thread creation in %s" .Kevt.Kparams.exe)
145+
(printf "Possible code injection by %s" .Kevt.PS.Exe)
146+
}}
150147
151148
# ======================= Network connection initiated ===============================================
152149
#
@@ -156,12 +153,10 @@
156153
- group: Suspicious network-connecting binaries
157154
selector:
158155
type: Connect
159-
enabled: true
160156
policy: include
161-
relation: or
162-
from-strings:
157+
rules:
163158
- name: Suspicious sources for network-connecting binaries
164-
def: ps.exe istartswith
159+
condition: ps.exe istartswith
165160
(
166161
'C:\\Users',
167162
'C:\\Recycle',
@@ -174,7 +169,7 @@
174169
'C:\\Windows\\system32\\config'
175170
)
176171
- name: Suspicious Windows tools network-connecting binaries
177-
def: ps.name in
172+
condition: ps.name in
178173
(
179174
'at.exe',
180175
'certutil.exe',
@@ -184,7 +179,7 @@
184179
'driverquery.exe',
185180
'dsquery.exe',
186181
'hh.exe',
187-
'infDefaultInstall.exe',
182+
'infconditionaultInstall.exe',
188183
'java.exe',
189184
'javaw.exe',
190185
'javaws.exe',
@@ -213,7 +208,7 @@
213208
'wscript.exe'
214209
)
215210
- name: Relevant 3rd Party Tools
216-
def: ps.name in
211+
condition: ps.name in
217212
(
218213
'nc.exe',
219214
'ncat.exe',
@@ -228,7 +223,7 @@
228223
'psinfo.exe'
229224
)
230225
- name: Suspicious ports
231-
def: net.dport in
226+
condition: net.dport in
232227
(
233228
22,
234229
23,
@@ -249,12 +244,10 @@
249244
- group: Microsoft binaries and known addresses
250245
selector:
251246
type: Connect
252-
enabled: true
253247
policy: exclude
254-
relation: or
255-
from-strings:
248+
rules:
256249
- name: Microsoft binaries
257-
def: ps.exe istartswith 'C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'
250+
condition: ps.exe istartswith 'C:\\ProgramData\\Microsoft\\Windows conditionender\\Platform\\'
258251
or
259252
ps.exe endswith 'AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe'
260253
or
@@ -265,41 +258,39 @@
265258
'microsoft.com.nsatc.net'
266259
)
267260
- name: OCSP protocol known addresses
268-
def: net.dip in (23.4.43.27, 72.21.91.29)
261+
condition: net.dip in (23.4.43.27, 72.21.91.29)
269262
- name: Loopback addresses
270-
def: net.dip = 127.0.0.1 or net.dip startswith 'fe80:0:0:0'
263+
condition: net.dip = 127.0.0.1 or net.dip startswith 'fe80:0:0:0'
271264

272265
# ======================= File created ===============================================================
273266
#
274267
- group: Suspicious file creation operations
275268
selector:
276269
type: CreateFile
277-
enabled: true
278270
policy: include
279-
relation: or
280-
from-strings:
271+
rules:
281272
- name: Startup links and shortcut modifications
282-
def: file.operation = 'create'
273+
condition: file.operation = 'create'
283274
and
284275
file.name icontains
285276
(
286277
'\\Start Menu',
287278
'\\Startup\\'
288279
)
289280
- name: Microsoft Outlook attachments
290-
def: file.operation = 'create' and file.name icontains '\\Content.Outlook\\'
281+
condition: file.operation = 'create' and file.name icontains '\\Content.Outlook\\'
291282
- name: Downloaded files
292-
def: file.operation = 'create' and file.name icontains '\\Downloads\\'
283+
condition: file.operation = 'create' and file.name icontains '\\Downloads\\'
293284
- name: Microsoft ClickOnce application
294-
def: file.operation = 'create'
285+
condition: file.operation = 'create'
295286
and
296287
file.extension in
297288
(
298289
'.application',
299290
'.appref-ms'
300291
)
301292
- name: Batch scripting
302-
def: file.operation = 'create'
293+
condition: file.operation = 'create'
303294
and
304295
file.extension in
305296
(
@@ -309,7 +300,7 @@
309300
'.cmdline'
310301
)
311302
- name: Fishy extensions
312-
def: file.operation = 'create'
303+
condition: file.operation = 'create'
313304
and
314305
file.extension in
315306
(
@@ -333,7 +324,7 @@
333324
'.xls'
334325
)
335326
- name: Powershell persistence
336-
def: file.operation = 'create'
327+
condition: file.operation = 'create'
337328
and
338329
file.name imatches 'C:\\Windows\\*\\WindowsPowerShell'
339330

@@ -342,12 +333,11 @@
342333
- group: Suspicious registry key modifications
343334
selector:
344335
category: registry
345-
enabled: true
346336
policy: include
347-
relation: or
348-
from-strings:
337+
rules:
349338
- name: Core Windows keys
350-
def: kevt.name in ('RegCreateKey', 'RegDeleteKey', 'RegSetValue', 'RegDeleteValue')
339+
condition: >
340+
kevt.name in ('RegCreateKey', 'RegDeleteKey', 'RegSetValue', 'RegDeleteValue')
351341
and
352342
registry.key.name icontains
353343
(
@@ -378,7 +368,7 @@
378368
)
379369
380370
- name: Services
381-
def: kevt.name in ('RegCreateKey', 'RegDeleteKey', 'RegSetValue', 'RegDeleteValue')
371+
condition: kevt.name in ('RegCreateKey', 'RegDeleteKey', 'RegSetValue', 'RegDeleteValue')
382372
and
383373
registry.key.name iendswith
384374
(

‎configs/rules/default/stateful.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
- group: remote connection and command shell execution
2+
policy: sequence
3+
rules:
4+
- name: establish remote connection
5+
condition: >
6+
kevt.name = 'Connect'
7+
and
8+
not
9+
cidr_contains(
10+
net.dip,
11+
'10.0.0.0/8',
12+
'172.16.0.0/12',
13+
'172.17.0.0/16',
14+
'192.168.0.0/16')
15+
- name: spawn command shell
16+
max-span: 1m
17+
condition: >
18+
kevt.name = 'CreateProcess'
19+
and
20+
ps.pid = $1.ps.pid
21+
and
22+
ps.sibling.name in ('cmd.exe', 'powershell.exe')
23+
action: >
24+
{{ emit "Command shell spawned after remote connection"
25+
(printf "%s process spawned a command shell after connecting to %s" .Kevts.k2.PS.Exe .Kevts.k1.Kparams.dip)
26+
}}

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ require (
1515
github.com/olivere/elastic/v7 v7.0.20
1616
github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2
1717
github.com/pkg/errors v0.9.1
18+
github.com/qmuntal/stateless v1.6.0 // indirect
1819
github.com/rifflock/lfshook v0.0.0-20180920164130-b9218ef580f5
1920
github.com/sirupsen/logrus v1.4.1
2021
github.com/spf13/cobra v0.0.3

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,8 @@ github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y8
142142
github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
143143
github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
144144
github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
145+
github.com/qmuntal/stateless v1.6.0 h1:gL34XLU4ZIGGEtlhbG1IBOty5Aoa8i+XY1YiRFtdLWk=
146+
github.com/qmuntal/stateless v1.6.0/go.mod h1:cWTwXu9ey+FxI0fHvDi1nGCtpYa8N1X2aOmoRg2RUCI=
145147
github.com/rifflock/lfshook v0.0.0-20180920164130-b9218ef580f5 h1:mZHayPoR0lNmnHyvtYjDeq0zlVHn9K/ZXoy17ylucdo=
146148
github.com/rifflock/lfshook v0.0.0-20180920164130-b9218ef580f5/go.mod h1:GEXHk5HgEKCvEIIrSpFI3ozzG5xOKA2DVlEX/gGnewM=
147149
github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=

‎pkg/config/_fixtures/filters/default-new-attributes.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
- group: internal network traffic
2+
enabled: false
3+
selector:
4+
type: Connect
5+
policy: exclude
6+
relation: and
7+
tags:
8+
- TE
9+
from-strings:
10+
- name: only network category
11+
def: kevt.category = 'net'
12+
13+
- group: rouge processes
14+
selector:
15+
category: net
16+
rules:
17+
- name: suspicious network {{ upper "activity" }}
18+
condition: kevt.category = 'net' and ps.name in ('at.exe', 'java.exe')

0 commit comments

Comments
 (0)