diff --git a/DSM MITRE Policy.xml b/DSM MITRE Policy.xml index 3f52d5a..9ff36bf 100644 --- a/DSM MITRE Policy.xml +++ b/DSM MITRE Policy.xml @@ -1,5 +1,5 @@ - + @@ -387,6 +387,31 @@ This rule will detect if the SSL/TLS server is using DHE weak parameters.false + + 1704C95A-DAF3-1896-49C9-8F9D78F14BCD + Detected Rlogin Server Traffic (ATT&CK T1021) + This filter detects Rlogin server traffic based on heuristics. Configuration options are provided to set the event frequency of this filter. + 2 + 350 + + false + true + true + false + 4 + 1 + 5.2.0.5272 + false + 300 + false + + false + false + -1 + -1.00 + false + + A82300FE-01CB-1DD5-5BA1-D0C8ECEBD724 Identified Usage Of EXPORT Cipher Suite In SSLv2 Connection (ATT&CK T1032) @@ -439,31 +464,6 @@ Note: This is a heuristic based rule which identifies if any Export cipher suite false - - 1704C95A-DAF3-1896-49C9-8F9D78F14BCD - Detected Rlogin Server Traffic (ATT&CK T1021) - This filter detects Rlogin server traffic based on heuristics. Configuration options are provided to set the event frequency of this filter. - 2 - 350 - - false - true - true - false - 4 - 1 - 5.2.0.5272 - false - 300 - false - - false - false - -1 - -1.00 - false - - 9810E353-00EF-D5E6-5E54-922366535F89 Detected Telnet Server Traffic (ATT&CK T1021) @@ -543,31 +543,6 @@ Note: Configuration options are provided to set the protocols disallowed, ports false - - E76366E5-EE43-CB07-D1C6-C32A60BA124D - FTP Server Possible Brute Force Attempt (ATT&CK T1110) - This filter detects a brute force attempt to gain the FTP Server Password by inspecting the number of failed logins in a time period. An attacker may use automated tools to iterate through all combinations or use a dictionary attack to guess passwords. - 2 - 236 - - false - true - true - false - 2 - 1 - 5.0.0.3000 - false - 300 - false - - false - false - 3 - -1.00 - false - - DD92DE83-238A-8522-7B4D-426559ED9E45 Identified Suspicious Obfuscated JavaScript (ATT&CK T1027) @@ -622,6 +597,31 @@ Note: Configuration option can be used to enter error responses of the mail serv false + + E76366E5-EE43-CB07-D1C6-C32A60BA124D + FTP Server Possible Brute Force Attempt (ATT&CK T1110) + This filter detects a brute force attempt to gain the FTP Server Password by inspecting the number of failed logins in a time period. An attacker may use automated tools to iterate through all combinations or use a dictionary attack to guess passwords. + 2 + 236 + + false + true + true + false + 2 + 1 + 5.0.0.3000 + false + 300 + false + + false + false + 3 + -1.00 + false + + A7C3B766-9C0A-B702-3BFB-77DDEEECCCEB Oracle Database Server Possible Brute Force Attempt (ATT&CK T1110) @@ -751,12 +751,14 @@ Note: The triggers of this rule have to be investigated further to confirm attac false - - FD4769AF-23BB-EE79-4130-855EFDEE9485 - Batch File Uploaded On Network Share (ATT&CK T1105) - This is a heuristic based rule which detects if a batch (.bat) file is being uploaded on the Network share using SMB protocol. + + 36B3D7AB-C33D-A104-4941-9B0AFB4A50EA + Identified Compression Algorithm In SSL/TLS (ATT&CK T1002) + This DPI rule detects the usage of compression algorithm in SSL/TLS traffic. The TLS protocol can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack. + +Note: Compression algorithm in SSL/TLS protocol is also used for legitimate purpose due to server limitations. Hence, every trigger of this rule should be investigated further to confirm an attack. Configuration options are provided to customize the alert frequency of the events. 2 - 343 + 303 false true @@ -764,7 +766,7 @@ Note: The triggers of this rule have to be investigated further to confirm attac false 1 1 - 6.0.0.0 + 5.2.0.0 false 300 false @@ -772,18 +774,16 @@ Note: The triggers of this rule have to be investigated further to confirm attac false false 3 - -1.00 + 2.60 false - - 36B3D7AB-C33D-A104-4941-9B0AFB4A50EA - Identified Compression Algorithm In SSL/TLS (ATT&CK T1002) - This DPI rule detects the usage of compression algorithm in SSL/TLS traffic. The TLS protocol can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack. - -Note: Compression algorithm in SSL/TLS protocol is also used for legitimate purpose due to server limitations. Hence, every trigger of this rule should be investigated further to confirm an attack. Configuration options are provided to customize the alert frequency of the events. + + FD4769AF-23BB-EE79-4130-855EFDEE9485 + Batch File Uploaded On Network Share (ATT&CK T1105) + This is a heuristic based rule which detects if a batch (.bat) file is being uploaded on the Network share using SMB protocol. 2 - 303 + 343 false true @@ -791,7 +791,7 @@ Note: Compression algorithm in SSL/TLS protocol is also used for legitimate purp false 1 1 - 5.2.0.0 + 6.0.0.0 false 300 false @@ -799,7 +799,7 @@ Note: Compression algorithm in SSL/TLS protocol is also used for legitimate purp false false 3 - 2.60 + -1.00 false @@ -1196,22 +1196,20 @@ Note: In some network environment, this rule could generate lots of trigger, the false - - 6C4E3209-67EF-18CA-3BE4-216E82A211E7 - Identified Remote Desktop Protocol (RDP) Brute Force Attempt (ATT&CK T1076) - This is a heuristic based rule which blocks the RDP brute force attempts. - -Note: In some network environment, this rule could generate lots of trigger, therefore trigger should be investigated further to confirm attack. + + 8D4566AF-E335-BDAF-54BB-05CB0945DDE0 + Prevent Windows Administrator User Login Over SMB (ATT&CK T1077) + This rule is intended to prevent SMB login attempts by user, "Administrator" of administrator account type on any Windows platforms. Using an Administrator account for normal tasks is not suggested as it bypasses all Windows security measures. 2 - 361 + 343 false true true false - 4 + 3 1 - 5.0.0.3000 + false 300 false @@ -1223,45 +1221,47 @@ Note: In some network environment, this rule could generate lots of trigger, the false - - EB093B14-6AF2-C675-2937-FBFFEA1E783F - Identified Suspicious RTF File With Obfuscated PowerShell Execution (ATT&CK T1027,T1086) - This is a heuristic based rule intended to block attempts to load suspicious Microsoft Word RTF files containing PowerShell code, over HTTP traffic. + + 9E11A36D-5594-706E-9426-21A67117B33C + Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1105) + This is a heuristic based rule which detects if executable file is being uploaded in the 'System32' directory through Network Share. 2 - 290 + 343 false true true false - 4 - 0 - + 1 + 1 + 6.0.0.0 false 300 false - 33569D94-0A79-8581-4ADF-FA9C285AD108 + false false - 1 - 9.30 + 3 + -1.00 false - - 8D4566AF-E335-BDAF-54BB-05CB0945DDE0 - Prevent Windows Administrator User Login Over SMB (ATT&CK T1077) - This rule is intended to prevent SMB login attempts by user, "Administrator" of administrator account type on any Windows platforms. Using an Administrator account for normal tasks is not suggested as it bypasses all Windows security measures. + + 6C4E3209-67EF-18CA-3BE4-216E82A211E7 + Identified Remote Desktop Protocol (RDP) Brute Force Attempt (ATT&CK T1076) + This is a heuristic based rule which blocks the RDP brute force attempts. + +Note: In some network environment, this rule could generate lots of trigger, therefore trigger should be investigated further to confirm attack. 2 - 343 + 361 false true true false - 3 + 4 1 - + 5.0.0.3000 false 300 false @@ -1273,28 +1273,28 @@ Note: In some network environment, this rule could generate lots of trigger, the false - - 9E11A36D-5594-706E-9426-21A67117B33C - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1105) - This is a heuristic based rule which detects if executable file is being uploaded in the 'System32' directory through Network Share. + + EB093B14-6AF2-C675-2937-FBFFEA1E783F + Identified Suspicious RTF File With Obfuscated PowerShell Execution (ATT&CK T1027,T1086) + This is a heuristic based rule intended to block attempts to load suspicious Microsoft Word RTF files containing PowerShell code, over HTTP traffic. 2 - 343 + 290 false true true false - 1 - 1 - 6.0.0.0 + 4 + 0 + false 300 false - + 33569D94-0A79-8581-4ADF-FA9C285AD108 false false - 3 - -1.00 + 1 + 9.30 false @@ -1323,6 +1323,33 @@ Note: In some network environment, this rule could generate lots of trigger, the false + + A07BE280-403E-6785-1E85-D596B6B4143B + Identified CBC Based Cipher Suite In SSLv3 Response (ATT&CK T1032) + This DPI rule detects the usage of CBC Based cipher suites in SSLv3.0 traffic. The CBC Based cipher suites use symmetric encryption algorithm in vulnerable SSL protocol to encrypt data with chained initialization vectors, which allows man-in-the-middle attackers to obtain plain-text HTTP headers via a block-wise chosen-boundary attack on an HTTPS session. + +Note: CBC Based cipher suites in SSLv3.0 protocol are also used for legitimate purpose due to server limitations. Hence, every trigger of this rule should be investigated further to confirm an attack. Configuration options are provided to customize the alert frequency of the events. + 2 + 303 + + false + true + true + false + 2 + 1 + 5.2.0.0 + false + 300 + false + + false + false + -1 + 4.30 + false + + BDAA9C96-579B-7083-8EF3-A3CBFA27E0EF Block Administrative Share - 1 (ATT&CK T1077,T1105) @@ -1349,30 +1376,28 @@ This filter blocks attempt to access administrative share on a windows machine.< false - - A07BE280-403E-6785-1E85-D596B6B4143B - Identified CBC Based Cipher Suite In SSLv3 Response (ATT&CK T1032) - This DPI rule detects the usage of CBC Based cipher suites in SSLv3.0 traffic. The CBC Based cipher suites use symmetric encryption algorithm in vulnerable SSL protocol to encrypt data with chained initialization vectors, which allows man-in-the-middle attackers to obtain plain-text HTTP headers via a block-wise chosen-boundary attack on an HTTPS session. - -Note: CBC Based cipher suites in SSLv3.0 protocol are also used for legitimate purpose due to server limitations. Hence, every trigger of this rule should be investigated further to confirm an attack. Configuration options are provided to customize the alert frequency of the events. + + AD883D37-A4E4-713A-2BA8-CCAA54E59A05 + Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1015,T1043,T1076,T1048,T1032,T1071) + This DPI rule detects RDP server traffic based on heuristics. An event indicates suspicious activity since RDP traffic over non-standard ports indicates the presence of a backdoor RDP server installation. 2 - 303 + 350 false true true false - 2 + 4 1 - 5.2.0.0 + 5.0.0.0 false 300 false false false - -1 - 4.30 + 3 + -1.00 false @@ -1428,31 +1453,6 @@ Note: This DPI rule should be applied ONLY in server environments where upload o false - - AD883D37-A4E4-713A-2BA8-CCAA54E59A05 - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1015,T1043,T1076,T1048,T1032,T1071) - This DPI rule detects RDP server traffic based on heuristics. An event indicates suspicious activity since RDP traffic over non-standard ports indicates the presence of a backdoor RDP server installation. - 2 - 350 - - false - true - true - false - 4 - 1 - 5.0.0.0 - false - 300 - false - - false - false - 3 - -1.00 - false - - E72233A6-A60B-7F70-7EEF-391CA76266C8 Identified WMI Query Over DCE/RPC Protocol (ATT&CK T1005) @@ -1632,22 +1632,20 @@ Note: Triggers of this rule have to be investigated further. false - - B56A1DA5-97B6-1EEF-B3AC-C423B9D1E6C5 - Identified Too Many Compressed HTTP Responses (ATT&CK T1002) - Data compression algorithms can be used by web servers to compress the HTTP responses. BREACH security tool exploits a property of compression algorithms to steal sensitive data. This is a heuristic based rule to identify too many compressed HTTP responses within a period of time. - -Note: Configuration options are provided to set the count, time period and event frequency of this rule. To monitor SSL Data Stream, agent (DSA) needs to be configured via "SSL Configuration Wizard" and has to acquire the Server SSL certificate where DPI rule is assigned. + + C5689773-87C7-2402-73E9-11132695AC63 + TMTR-0016: SPLINTER RAT TCP Connection (ATT&CK T1094) + A remote access tool (or RAT) is a software used to access a remote computer often used for malicious activities. This smart rule identifies suspicious RAT traffic. 2 - 330 + 271 false true true false - 3 + 4 1 - 6.0.0.0 + false 300 false @@ -1655,24 +1653,26 @@ Note: Configuration options are provided to set the count, time period and event false false 3 - 7.80 + -1.00 false - - C5689773-87C7-2402-73E9-11132695AC63 - TMTR-0016: SPLINTER RAT TCP Connection (ATT&CK T1094) - A remote access tool (or RAT) is a software used to access a remote computer often used for malicious activities. This smart rule identifies suspicious RAT traffic. + + B56A1DA5-97B6-1EEF-B3AC-C423B9D1E6C5 + Identified Too Many Compressed HTTP Responses (ATT&CK T1002) + Data compression algorithms can be used by web servers to compress the HTTP responses. BREACH security tool exploits a property of compression algorithms to steal sensitive data. This is a heuristic based rule to identify too many compressed HTTP responses within a period of time. + +Note: Configuration options are provided to set the count, time period and event frequency of this rule. To monitor SSL Data Stream, agent (DSA) needs to be configured via "SSL Configuration Wizard" and has to acquire the Server SSL certificate where DPI rule is assigned. 2 - 271 + 330 false true true false - 4 + 3 1 - + 6.0.0.0 false 300 false @@ -1680,7 +1680,7 @@ Note: Configuration options are provided to set the count, time period and event false false 3 - -1.00 + 7.80 false @@ -2228,6 +2228,33 @@ NOTE: This rule will prevent only the outgoing IP Messenger traffic. To prevent false + + 2B2CE9E2-0512-F86C-5910-54A01794B5E1 + TeamViewer (ATT&CK T1219) + This is a heuristics based filter which detects the usage of TeamViewer, a remote administration tool. Configuration options are provided to set the event frequency of this filter. + +Note: This filter detects and blocks the use of TeamViewer + 2 + 325 + + false + true + true + false + 4 + 1 + 5.2.0.0 + false + 300 + false + + false + false + -1 + -1.00 + false + + 04A0EF26-AD16-7F55-02F1-5415BD0C6F88 Remote Schedule Task 'Run' Through SMBv2 Protocol Detected (ATT&CK T1053) @@ -2280,14 +2307,13 @@ Note: A configuration option is provided to set the event frequency and to creat false - - 2B2CE9E2-0512-F86C-5910-54A01794B5E1 - TeamViewer (ATT&CK T1219) - This is a heuristics based filter which detects the usage of TeamViewer, a remote administration tool. Configuration options are provided to set the event frequency of this filter. - -Note: This filter detects and blocks the use of TeamViewer + + F6A032C9-B1A6-490F-39C2-62D76B5507F9 + Windows Live FolderShare (ATT&CK T1102) + This filter detects Windows Live FolderShare (currently known as Windows Live Sync) P2P client traffic based on heuristics. It also provides configuration options to set the event frequency of the filter. +Note: This filter only detects FolderShare traffic and blocks non-encrypted transfers only. 2 - 325 + 320 false true @@ -2359,13 +2385,14 @@ Note: CBC Based cipher suites in SSLv3.0 protocol are also used for legitimate p false - - F6A032C9-B1A6-490F-39C2-62D76B5507F9 - Windows Live FolderShare (ATT&CK T1102) - This filter detects Windows Live FolderShare (currently known as Windows Live Sync) P2P client traffic based on heuristics. It also provides configuration options to set the event frequency of the filter. -Note: This filter only detects FolderShare traffic and blocks non-encrypted transfers only. + + 56F3FDC1-C1B5-533C-44E1-B6F9FAEF668F + Yahoo! Messenger File Transfers (ATT&CK T1102) + This is a heuristics based filter that blocks Yahoo! Messenger file transfers. Configuration options are provided to set the event frequency of this filter. + +Note: The filter can not detect Yahoo Messenger File Transfer over HTTP connection method. 2 - 320 + 322 false true @@ -2410,33 +2437,6 @@ Note: This filter only detects FolderShare traffic and blocks non-encrypted tran false - - 56F3FDC1-C1B5-533C-44E1-B6F9FAEF668F - Yahoo! Messenger File Transfers (ATT&CK T1102) - This is a heuristics based filter that blocks Yahoo! Messenger file transfers. Configuration options are provided to set the event frequency of this filter. - -Note: The filter can not detect Yahoo Messenger File Transfer over HTTP connection method. - 2 - 322 - - false - true - true - false - 4 - 1 - 5.2.0.0 - false - 300 - false - - false - false - -1 - -1.00 - false - - 4B9486A7-4467-A201-8CE9-96CAC6D7E46F Identified Suspicious China Chopper Webshell Communication (ATT&CK T1100) @@ -2540,6 +2540,83 @@ This is a heuristic based rule, which logs SSL traffic with weak Cipher.false + + FDBE0725-C0E3-AAB8-DBD7-05A0CBA15F09 + Identified Usage Of PAExec Command Line Tool (ATT&CK T1035) + PAExec is a command line tool that execute processes on remote systems and redirect console application output to the local system so that these applications appear to be running locally. This rule identifies the use of PAExec tool through SMB share. PAExec is very powerful tool and used by malware and exploits for lateral movement in the network. + +Note: Administrators are suggested to add trusted IP addresses in the configuration page. The rule will block all PAExec attempts unless configured. + 2 + 343 + + false + true + true + false + 1 + 1 + 6.0.0.0 + false + 300 + false + + false + false + 3 + -1.00 + false + + + + 601AC30F-F8C6-7EAC-F428-47D9F40A8958 + Identify Downloading Of PowerShell Scripts Through SMB Share (ATT&CK T1086) + PowerShell may also be used to download and run PowerShell scripts from the Internet, which can be executed from disk or in memory without touching disk. Adversaries may use PowerShell to execute malicious PowerShell scripts that may cause Damage of the system. + 2 + 355 + + false + true + true + false + 4 + 1 + + false + 300 + false + + false + false + 1 + -1.00 + false + + + + C87AE28B-2FE6-F999-0517-9D7F2A4B8F04 + WinRM Service Detected & Powershell RCE Over HTTP - Client (ATT&CK T1028) + Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). This filter detects its generic usage as well as through PowerShell. + 2 + 377 + + false + true + true + false + 2 + 1 + + false + 300 + false + + false + false + 3 + -1.00 + false + + D01CA71F-E43D-C9DE-BE47-01E5D32979E3 Identified Remote Service Creation Over DCE/RPC Protocol (ATT&CK T1050) @@ -2565,30 +2642,30 @@ This is a heuristic based rule, which logs SSL traffic with weak Cipher.false - - 1951B82E-C7BB-98D5-2311-B5B50FFFEE8A - Identified Finger Service Traffic (ATT&CK T1021) - 'finger' service is a legacy service returning sensitive information about user accounts present on a given system. A remote attacker can use it to obtain valid account names and may perform further attacks. + + 24786B45-FCA8-276F-95BE-20AE5AF52817 + WinRM Service Detected & Powershell RCE Over HTTP (ATT&CK T1028) + Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). This filter detects its generic usage as well as through PowerShell. -Supported Platforms : non-Windows +Note: In some network environments, this rule can generate many triggers and will need further investigation to confirm an attack. 2 - 350 + 371 false true true false - 1 + 3 1 - 6.0.0.0 + false 300 false false false - -1 - 0.00 + 3 + -1.00 false @@ -2617,6 +2694,33 @@ Supported Platforms : non-Windows false + + 1951B82E-C7BB-98D5-2311-B5B50FFFEE8A + Identified Finger Service Traffic (ATT&CK T1021) + 'finger' service is a legacy service returning sensitive information about user accounts present on a given system. A remote attacker can use it to obtain valid account names and may perform further attacks. + +Supported Platforms : non-Windows + 2 + 350 + + false + true + true + false + 1 + 1 + 6.0.0.0 + false + 300 + false + + false + false + -1 + 0.00 + false + + 2BAFA882-67E9-F429-CF19-71D2903E1612 SMTP Client (ATT&CK T1071,T1048) @@ -2850,11 +2954,11 @@ Note: Configuration options have been provided to select the file extensions. Wi false - - 9A31C777-ACF5-7627-77BC-4C4AFC21EEE7 - Detect UPX Packed Executable Download (ATT&CK T1045) - UPX is a universal file compressor and packer for executable files. This filter blocks the download to UPX packed executable files. - 2 + + 33569D94-0A79-8581-4ADF-FA9C285AD108 + HTTP Web Client Decoding + This is a smart filter that decodes the Web Client traffic and is used by other web client filters. + 1 290 false @@ -2862,24 +2966,24 @@ Note: Configuration options have been provided to select the file extensions. Wi true false 4 - 1 - + 0 + 5.0.0.0 false 300 false false - false - 3 - 9.30 + true + 1 + -1.00 false - - 33569D94-0A79-8581-4ADF-FA9C285AD108 - HTTP Web Client Decoding - This is a smart filter that decodes the Web Client traffic and is used by other web client filters. - 1 + + 9A31C777-ACF5-7627-77BC-4C4AFC21EEE7 + Detect UPX Packed Executable Download (ATT&CK T1045) + UPX is a universal file compressor and packer for executable files. This filter blocks the download to UPX packed executable files. + 2 290 false @@ -2887,16 +2991,16 @@ Note: Configuration options have been provided to select the file extensions. Wi true false 4 - 0 - 5.0.0.0 + 1 + false 300 false false - true - 1 - -1.00 + false + 3 + 9.30 false @@ -3358,20 +3462,18 @@ Note: Compression algorithm in SSL/TLS protocol is also used for legitimate purp false - - 625B1F4D-70F6-32E9-18F4-1A78C524E34D - Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1032) - This rule heuristically detects the exchange of Secure Socket Layer (SSL) certificate, which is being used to create reverse HTTPS channel from compromised machine. - -Note: Configuration options are provided to configure valid/legitimate CAs (Certificate Authority) if this rule detects any benign traffic. + + F2B3EC84-F1CB-EC42-8082-CEF905D85A10 + Identified OpenSSL SRP Cipher Suite In Server Hello Message (ATT&CK T1032) + This DPI rule detects the usage of SRP cipher suite in server hello message. OpenSSL clients enabling SRP ciphersuites are subject to a denial of service attack. A malicious server can crash the client with a null pointer dereference (read) by specifying an SRP ciphersuite even though it was not properly negotiated with the client. 2 - 271 + 257 false true true false - 4 + 2 1 5.2.0.0 false @@ -3381,23 +3483,23 @@ Note: Configuration options are provided to configure valid/legitimate CAs (Cert false false 3 - -1.00 + 4.30 false - - F2B3EC84-F1CB-EC42-8082-CEF905D85A10 - Identified OpenSSL SRP Cipher Suite In Server Hello Message (ATT&CK T1032) - This DPI rule detects the usage of SRP cipher suite in server hello message. OpenSSL clients enabling SRP ciphersuites are subject to a denial of service attack. A malicious server can crash the client with a null pointer dereference (read) by specifying an SRP ciphersuite even though it was not properly negotiated with the client. + + 82DC40AF-890E-EC7A-7A5A-FEC36C90CE01 + Yahoo! Messenger (ATT&CK T1102) + This is a heuristics based filter to detect Yahoo! Messenger Client login attempts. Configuration options are provided to set the event frequency of this filter. 2 - 257 + 322 false true true false - 2 - 1 + 4 + 0 5.2.0.0 false 300 @@ -3405,24 +3507,26 @@ Note: Configuration options are provided to configure valid/legitimate CAs (Cert false false - 3 - 4.30 + -1 + -1.00 false - - 82DC40AF-890E-EC7A-7A5A-FEC36C90CE01 - Yahoo! Messenger (ATT&CK T1102) - This is a heuristics based filter to detect Yahoo! Messenger Client login attempts. Configuration options are provided to set the event frequency of this filter. + + 625B1F4D-70F6-32E9-18F4-1A78C524E34D + Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1032) + This rule heuristically detects the exchange of Secure Socket Layer (SSL) certificate, which is being used to create reverse HTTPS channel from compromised machine. + +Note: Configuration options are provided to configure valid/legitimate CAs (Certificate Authority) if this rule detects any benign traffic. 2 - 322 + 271 false true true false 4 - 0 + 1 5.2.0.0 false 300 @@ -3430,7 +3534,7 @@ Note: Configuration options are provided to configure valid/legitimate CAs (Cert false false - -1 + 3 -1.00 false @@ -3642,12 +3746,12 @@ NOTE: Telegram Bot service has been known to be used by malware like Telecrypt f false - - 8EF9201A-F997-3E0D-DE63-91CADDAFB37F - Identified Potentially Malicious RAT Traffic - I (ATT&CK T1094) - A remote access tool (or RAT) is a software used to access a remote computer often used for malicious activities. This smart rule identifies suspicious RAT traffic. + + D083181F-22B5-94E4-A691-7DC4A3966E73 + Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021) + This filter detects VNC server traffic based on heuristics. Configuration options are provided to customize ports to inspect or ignore traffic and to set the event frequency of this filter. After appropriate configuration, an event would indicate suspicious activity since VNC traffic over non-standard ports indicates the presence of a backdoor VNC server installation. 2 - 271 + 350 false true @@ -3662,17 +3766,17 @@ NOTE: Telegram Bot service has been known to be used by malware like Telecrypt f false false - 3 + -1 -1.00 false - - D083181F-22B5-94E4-A691-7DC4A3966E73 - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021) - This filter detects VNC server traffic based on heuristics. Configuration options are provided to customize ports to inspect or ignore traffic and to set the event frequency of this filter. After appropriate configuration, an event would indicate suspicious activity since VNC traffic over non-standard ports indicates the presence of a backdoor VNC server installation. + + 8EF9201A-F997-3E0D-DE63-91CADDAFB37F + Identified Potentially Malicious RAT Traffic - I (ATT&CK T1094) + A remote access tool (or RAT) is a software used to access a remote computer often used for malicious activities. This smart rule identifies suspicious RAT traffic. 2 - 350 + 271 false true @@ -3687,7 +3791,7 @@ NOTE: Telegram Bot service has been known to be used by malware like Telecrypt f false false - -1 + 3 -1.00 false @@ -6520,6 +6624,14 @@ logon failure Informational false + + 42BB22E7-FBFD-6610-D83D-09C91045DA4E + 1 + 7070 + AllowedIP + + true + @@ -7857,6 +7969,25 @@ logon failure -1 + + 20577010-627A-BD30-57DA-729D9D200B9A + Windows Remote Management Client + Identify the usage of WinRM on client machine to detect the originating machine in case of using WinRM for lateral movement. + 2 + 6 + 1 + 5985 + + 8 + 0 + 2 + 2 + false + + + + -1 + @@ -7962,1018 +8093,1042 @@ logon failure - + 10 - 2467 + 5830 true - + 10 - 3449 + 4998 true - + 10 - 5870 + 1358 true - + 10 - 4177 + 5015 true - + 10 - 2298 + 6962 true - + 10 - 6293 + 3271 true - + 10 - 5007 + 5912 true - + 10 - 4990 + 3610 true - + 10 - 4042 + 5031 true - + 10 - 3448 + 4203 true - + 10 - 4160 + 5725 true - + 10 - 4379 + 5014 true - + 10 - 3312 + 2121 true - + 10 - 2297 + 2881 true - + 10 - 4043 + 3609 true - + 10 - 4989 + 1307 true - + 10 - 2331 + 5032 true - + 10 - 6864 + 4983 true - + 10 - 4107 + 4285 true - + 10 - 6393 + 1309 true - + 10 - 4192 + 3167 true - + 10 - 7007 + 5644 true - + 10 - 6865 + 4861 true - + 10 - 3332 + 3201 true - + 10 - 5361 + 4201 true - + 10 - 5782 + 5507 true - + 10 - 7005 + 4199 true - + 10 - 6394 + 3357 true - + 10 - 5008 + 2883 true - + 10 - 7004 + 5826 true - + 10 - 6866 + 6333 true - + 10 - 4198 + 4977 true - + 10 - 5781 + 4994 true - + 10 - 6399 + 6196 true - + 10 - 1252 + 6424 true - + 10 - 3614 + 7008 true - + 10 - 4037 + 3225 true - + 10 - 6962 + 2640 true - + 10 - 4180 + 5027 true - + 10 - 5162 + 5257 true - + 10 - 4197 + 4046 true - + 10 - 5213 + 5272 true - + 10 - 4985 + 3342 true - + 10 - 5728 + 3105 true - + 10 - 6397 + 6838 true - + 10 - 7006 + 4292 true - + 10 - 6295 + 7007 true - + 10 - 2338 + 5509 true - + 10 - 6485 + 3054 true - + 10 - 1220 + 4189 true - + 10 - 5330 + 4976 true - + 10 - 2923 + 3015 true - + 10 - 6398 + 4979 true - + 10 - 6347 + 5013 true - + 10 - 2337 + 1297 true - + 10 - 6294 + 5665 true - + 10 - 4041 + 3053 true - + 10 - 7018 + 4996 true - + 10 - 6484 + 4581 true - + 10 - 2458 + 5736 true - + 10 - 3043 + 2330 true - + 10 - 6226 + 2880 true - + 10 - 5004 + 5614 true - + 10 - 5486 + 4290 true - + 10 - 5830 + 6561 true - + 10 - 4998 + 6440 true - + 10 - 1358 + 2639 true - + 10 - 5015 + 7009 true - + 10 - 3271 + 1950 true - + 10 - 5912 + 5064 true - + 10 - 3610 + 5030 true - + 10 - 5031 + 5047 true - + 10 - 4203 + 4204 true - + 10 - 5725 + 2467 true - + 10 - 5014 + 3449 true - + 10 - 2121 + 5870 true - + 10 - 2881 + 4177 true - + 10 - 3609 + 7004 true - + 10 - 1307 + 2298 true - + 10 - 5032 + 6293 + true + + + + 10 + 5007 true - + + + 10 + 4990 + true + + 10 6902 true - + 10 - 4983 + 4042 true - + 10 - 4285 + 3448 true - + 10 - 1309 + 4160 true - + 10 - 3167 + 7072 true - + 10 - 7008 + 4379 true - + 10 - 5644 + 7003 true - + 10 - 4861 + 3312 true - + 10 - 3201 + 2297 true - + 10 - 4201 + 4043 true - + 10 - 5507 + 4989 true - + 10 - 4199 + 2331 true - + 10 - 3357 + 6903 true - + 10 - 2883 + 7071 true - + 10 - 5826 + 4107 true - + 10 - 6333 + 7006 true - + 10 - 6903 + 6393 true - + 10 - 4977 + 4192 true - + 10 - 4994 + 3332 true - + 10 - 6196 + 7073 true - + 10 - 6424 + 5361 true - + 10 - 3225 + 5782 true - + 10 - 2640 + 7005 true - + 10 - 5027 + 6866 true - + 10 - 7003 + 6394 true - + 10 - 5257 + 5008 true - + 10 - 4046 + 4198 true - + 10 - 5272 + 5781 true - + 10 - 3342 + 6399 true - + 10 - 3105 + 1252 true - + 10 - 4292 + 3614 true - + 10 - 5509 + 4037 true - + 10 - 3054 + 6865 true - + 10 - 4189 + 7001 true - + 10 - 4976 + 4180 true - + 10 - 7002 + 5162 true - + 10 - 3015 + 4197 true - + 10 - 4979 + 5213 true - + 10 - 6838 + 6864 true - + 10 - 5013 + 4985 true - + 10 - 1297 + 5728 true - + 10 - 5665 + 7002 true - + 10 - 3053 + 6397 true - + 10 - 4996 + 6295 true - + 10 - 4581 + 2338 true - + 10 - 5736 + 6485 true - + 10 - 2330 + 7070 true - + 10 - 2880 + 1220 true - + 10 - 5614 + 5330 true - + 10 - 7001 + 2923 true - + 10 - 4290 + 6398 true - + 10 - 6561 + 6347 true - + 10 - 7009 + 7018 true - + 10 - 6440 + 2337 true - + 10 - 2639 + 6294 true - + 10 - 1950 + 4041 true - + 10 - 5064 + 6484 true - + 10 - 5030 + 2458 true - + 10 - 5047 + 3043 true - + 10 - 4204 + 6226 + true + + + + 10 + 5004 + true + + + + 10 + 5486 true - + 10 - 211 + 304 true - + 10 - 304 + 211 true - + 10 - 215 + 325 true - + 10 - 325 + 215 true - + 10 355 true - + 10 270 true - + 10 - 257 + 330 true - + 10 - 330 + 257 true - + 10 308 true - + 10 322 true - - - 10 - 326 - true - - + 10 271 true - + 10 - 343 + 326 true - + 10 72 true - + 10 - 155 + 343 true - + 10 - 227 + 155 true - + 10 - 236 + 227 true - + 10 361 true - + 10 - 371 + 236 true - + 10 285 true - + 10 323 true - + 10 213 true - + 10 263 true - + 10 303 true - + 10 - 328 + 371 true - + 10 - 350 + 328 true - + 10 311 true - + + + 10 + 350 + true + + 10 290 true - + 10 320 @@ -9031,33 +9186,33 @@ The rule also provides configuration options to ignore monitoring services and t 6.0.0 - - 0666E804-FA3F-250C-76AA-656D3C7DE247 - TMTR-0005: Suspicious Files Detected In Application Directories - This generic rule is intended to alert when highly suspicious malware specific file entity is created or modified. - -This rule is applicable to Windows platforms. - 2 + + 4255223A-631D-241C-8C11-7C49C8ED33D5 + Microsoft Windows - System .dll or .exe files modified (ATT&CK T1013) + This rule alerts when there is a change in file attributes Created, LastModified, Permissions, Owner, Group, Size and Contents of .dll or .exe files under %WINDIR%\system32 path. Also the rule provides configuration option to ignore files for monitoring and to select the file attributes to monitor. + 3 true 6.0.0.0 false false false - -1 + 1 6.0.0 - - 4255223A-631D-241C-8C11-7C49C8ED33D5 - Microsoft Windows - System .dll or .exe files modified (ATT&CK T1013) - This rule alerts when there is a change in file attributes Created, LastModified, Permissions, Owner, Group, Size and Contents of .dll or .exe files under %WINDIR%\system32 path. Also the rule provides configuration option to ignore files for monitoring and to select the file attributes to monitor. - 3 + + 0666E804-FA3F-250C-76AA-656D3C7DE247 + TMTR-0005: Suspicious Files Detected In Application Directories + This generic rule is intended to alert when highly suspicious malware specific file entity is created or modified. + +This rule is applicable to Windows platforms. + 2 true 6.0.0.0 false false false - 1 + -1 6.0.0 @@ -9299,6 +9454,22 @@ This rule is applicable to Windows platforms. 6.0.0 + + 3473B2B0-C5BE-770D-337C-494C40E47AAF + TMTR-0026: Suspicious Files Detected In Program FIles Folder + This generic rule is intended to alert when highly suspicious malware specific file entity is created or modified. + +This rule is applicable to Windows platforms. + 2 + true + 6.0.0.0 + false + false + false + -1 + + 6.0.0 + 238CFE8C-C4FE-5F30-BB60-57F95BD7BEF9 Component Object Model Hijacking (ATT&CK T1122, T1112) @@ -9314,12 +9485,10 @@ Hijacking a COM object requires a change in the Windows Registry to replace a re 6.0.0 - - 3473B2B0-C5BE-770D-337C-494C40E47AAF - TMTR-0026: Suspicious Files Detected In Program FIles Folder - This generic rule is intended to alert when highly suspicious malware specific file entity is created or modified. - -This rule is applicable to Windows platforms. + + 6DAD9619-F733-CC3C-35FB-735E7A6DC7A6 + Port Monitor (ATT&CK T1013) + Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM. 2 true 6.0.0.0 @@ -9346,11 +9515,13 @@ This rule is applicable to Windows platforms. 6.0.0 - - 6DAD9619-F733-CC3C-35FB-735E7A6DC7A6 - Port Monitor (ATT&CK T1013) - Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM. - 2 + + 5E8890B4-EBDF-2AE9-D386-943C5F703A61 + Application Shimming (ATT&CK T1138) + The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. + +However, certain shims can be abused. Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. + 2 true 6.0.0.0 false @@ -9376,22 +9547,6 @@ This rule is applicable to Windows platforms. 6.0.0 - - 5E8890B4-EBDF-2AE9-D386-943C5F703A61 - Application Shimming (ATT&CK T1138) - The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. - -However, certain shims can be abused. Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. - 2 - true - 6.0.0.0 - false - false - false - -1 - - 6.0.0 - 9672834F-9733-EABE-5BF9-3A0058D5EA34 AppCert DLLs (ATT&CK T1182) @@ -9407,11 +9562,13 @@ This value can be abused to obtain persistence and privilege escalation by causi 6.0.0 - - 08420A46-33D0-D154-35A3-279EB8D2A912 - PowerShell & CommandLine (ATT&CK T1086,T1059) - This rule monitors the execution of the command prompt and PowerShell, along with PowerShell execution policy registry key, and the WinRM service. - 2 + + DFD8BB39-CDED-C1C6-B62E-4F904DEE98B8 + TMTR-0003: Suspicious Files Detected In Operating System Directories + This generic rule is intended to alert when highly suspicious malware specific file entity is created or modified. + +This rule is applicable to Windows platforms. + 1 true 6.0.0.0 false @@ -9421,13 +9578,11 @@ This value can be abused to obtain persistence and privilege escalation by causi 6.0.0 - - DFD8BB39-CDED-C1C6-B62E-4F904DEE98B8 - TMTR-0003: Suspicious Files Detected In Operating System Directories - This generic rule is intended to alert when highly suspicious malware specific file entity is created or modified. - -This rule is applicable to Windows platforms. - 1 + + 08420A46-33D0-D154-35A3-279EB8D2A912 + PowerShell & CommandLine (ATT&CK T1086,T1059) + This rule monitors the execution of the command prompt and PowerShell, along with PowerShell execution policy registry key, and the WinRM service. + 2 true 6.0.0.0 false @@ -9862,7 +10017,7 @@ This rule is applicable to Windows platforms. 10 150 - true + false false @@ -10580,235 +10735,230 @@ This rule is applicable to Windows platforms. - + 10 - 73 - - - - 10 - 64 + 153 - + 10 - 150 + 144 - + 10 - 77 + 70 - + 10 - 158 + 75 - + 10 - 65 + 148 - + 10 - 82 + 96 - + 10 - 69 + 152 - + 10 - 99 + 2 - + 10 - 56 + 79 - + 10 - 1 + 67 - + 10 - 74 + 71 - + 10 - 145 + 97 - + 10 - 108 + 156 - + 10 - 78 + 147 - + 10 - 149 + 76 - + 10 - 66 + 151 - + 10 - 83 + 59 - + 10 - 104 + 80 - + 10 - 153 + 89 - + 10 - 144 + 63 - + 10 - 70 + 85 - + 10 - 75 + 68 - + 10 - 148 + 159 - + 10 - 96 + 81 - + 10 - 152 + 72 - + 10 - 2 + 155 - + 10 - 79 + 146 - + 10 - 67 + 73 - + 10 - 71 + 64 - + 10 - 97 + 77 - + 10 - 156 + 158 - + 10 - 147 + 65 - + 10 - 76 + 82 - + 10 - 151 + 69 - + 10 - 59 + 99 - + 10 - 80 + 56 - + 10 - 89 + 1 - + 10 - 63 + 74 - + 10 - 85 + 145 - + 10 - 68 + 108 - + 10 - 159 + 78 - + 10 - 81 + 149 - + 10 - 72 + 66 - + 10 - 155 + 83 - + 10 - 146 + 104 @@ -11134,7 +11284,7 @@ Platform: Microsoft Windows 57 true 5 - false + true @@ -17180,504 +17330,942 @@ Platform: Microsoft Windows - + 10 1945 -1 - + 10 1944 -1 - + 10 1943 -1 - + 10 1942 -1 - + 10 1941 -1 - + 10 1940 -1 - + 10 1939 -1 - + 10 1938 -1 - + 10 1937 -1 - + 10 1936 -1 - + 10 1935 -1 - + 10 1934 -1 - + 10 1933 -1 - + 10 1932 -1 - + 10 1931 -1 - + 10 1930 -1 - + 10 1929 -1 - + 10 1928 -1 - + 10 1927 -1 - + 10 1926 -1 - + 10 1925 -1 - + 10 1924 -1 - + 10 1923 -1 - + 10 1922 -1 - + 10 1921 -1 - + 10 1920 -1 - + 10 1919 -1 - + 10 1918 -1 - + 10 1917 -1 - + 10 1916 -1 - + 10 1915 -1 - + 10 1914 -1 - + 10 1913 -1 - + 10 1912 -1 - + 10 1911 -1 - + 10 1910 -1 - + 10 1909 -1 - + 10 1908 -1 - + 10 1907 -1 - + 10 1906 -1 - + 10 1905 -1 - + 10 1904 -1 - + 10 1903 -1 - + 10 1902 -1 - + 10 1901 -1 - + 10 1900 -1 - + 10 1899 -1 - + 10 1898 -1 - + 10 1897 -1 - + 10 1896 -1 - + 10 1895 -1 - + 10 1894 -1 - + 10 1893 -1 - + 10 1892 -1 - + 10 1891 -1 - + 10 1890 -1 - + 10 1888 -1 - + 10 1887 -1 - + 10 1886 -1 - + 10 1885 -1 - + 10 1884 -1 - + 10 1883 - 1 + -1 - + 10 1882 -1 - + 10 1881 -1 - + 10 1880 -1 - + 10 1879 -1 - + 10 1878 -1 - + 10 1874 -1 - + 10 1873 -1 - + 10 1872 -1 + + 10 + + 1994 + -1 + + + 10 + + 1820 + -1 + + + 10 + + 1819 + 120 + + + 10 + + 1818 + 10 + + + 10 + + 1817 + -1 + + + 10 + + 1816 + -1 + + + 10 + + 1815 + -1 + + + 10 + + 1814 + -1 + + + 10 + + 1813 + -1 + + + 10 + + 1812 + -1 + + + 10 + + 1811 + -1 + + + 10 + + 1810 + -1 + + + 10 + + 1809 + -1 + + + 10 + + 1808 + -1 + + + 10 + + 1807 + -1 + + + 10 + + 1806 + -1 + + + 10 + + 1805 + -1 + + + 10 + + 1804 + -1 + + + 10 + + 1803 + -1 + + + 10 + + 1802 + -1 + + + 10 + + 1801 + -1 + + + 10 + + 1800 + 10 + + + 10 + + 1799 + -1 + + + 10 + + 1798 + -1 + + + 10 + + 1797 + -1 + + + 10 + + 1796 + -1 + + + 10 + + 1795 + -1 + + + 10 + + 1794 + -1 + + + 10 + + 1793 + -1 + + + 10 + + 1792 + -1 + + + 10 + + 1791 + -1 + + + 10 + + 1790 + -1 + + + 10 + + 1789 + -1 + + + 10 + + 1788 + -1 + + + 10 + + 1787 + -1 + + + 10 + + 1786 + -1 + + + 10 + + 1785 + -1 + + + 10 + + 1784 + -1 + + + 10 + + 1783 + -1 + + + 10 + + 1782 + -1 + + + 10 + + 1781 + -1 + + + 10 + + 1780 + -1 + + + 10 + + 1779 + -1 + + + 10 + + 1778 + -1 + + + 10 + + 1777 + -1 + + + 10 + + 1776 + -1 + + + 10 + + 1775 + -1 + + + 10 + + 1774 + -1 + + + 10 + + 1773 + -1 + + + 10 + + 1772 + -1 + + + 10 + + 1771 + -1 + + + 10 + + 1770 + -1 + + + 10 + + 1769 + 120 + + + 10 + + 1768 + -1 + + + 10 + + 1767 + -1 + + + 10 + + 1766 + -1 + + + 10 + + 1765 + -1 + + + 10 + + 1764 + -1 + + + 10 + + 1763 + -1 + + + 10 + + 1762 + 6 + + + 10 + + 1761 + -1 + + + 10 + + 1760 + -1 + + + 10 + + 1759 + -1 + + + 10 + + 1758 + -1 + + + 10 + + 1757 + -1 + + + 10 + + 1756 + -1 + + + 10 + + 1755 + -1 + + + 10 + + 1754 + -1 + + + 10 + + 1753 + -1 + + + 10 + + 1752 + -1 + + + 10 + + 1751 + -1 + + + 10 + + 1750 + eventlog + + + 10 + + 1749 + System,Application,Security,Directory Service,File Replication Service + - + 10 48 - + 10 29 - + 10 46 - + 10 31 - + 10 56 - + 10 57 - + 10 59 - + 10 61 - + 10 50 - + 10 63 - + 10 20 - + 10 30 - + 10 47 - + 10 40 - + 10 60 - + 10 62