valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Splitting into two rules

Browse Source
This commit is contained in:
Наталья Шорникова 2020-10-28 19:08:23 +03:00
parent 3aa2a73ba7
commit 55a7fe6b9d
2 changed files with 28 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml
View File

@ -19,18 +19,6 @@ detection:
ScriptBlockText|contains|all:
- 'CL_Invocation.ps1'
- 'SyncInvoke'
selection2:
EventID: 4104
ScriptBlockText|contains:
- 'CL_Invocation.ps1'
- 'SyncInvoke'
timeframe: 1m
condition:
- selection
- selection2 | count(ScriptBlockText) by Computer > 2
# PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1; SyncInvoke c:\Evil.exe
# or
# PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1
# PS > SyncInvoke c:\Evil.exe
condition: selection
falsepositives: Unknown
level: high

26
rules/windows/powershell/powershell_CL_Invocation_LOLScript_v2.yml Normal file
View File

@ -0,0 +1,26 @@
title: Execution via CL_Invocation.ps1
id: 4cd29327-685a-460e-9dac-c3ab96e549dc
description: Detects Execution via SyncInvoke in CL_Invocation.ps1 module
status: experimental
author: oscd.community, Natalia Shornikova
date: 2020/10/14
references:
- https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/Cl_invocation.yml
- https://twitter.com/bohops/status/948061991012327424
tags:
- attack.defense_evasion
- attack.t1216
logsource:
product: windows
service: powershell
detection:
selection2:
EventID: 4104
ScriptBlockText|contains:
- 'CL_Invocation.ps1'
- 'SyncInvoke'
condition: selection2 | count(ScriptBlockText) by Computer > 2
# PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1
# PS > SyncInvoke c:\Evil.exe
falsepositives: Unknown
level: high