Skip to content

Commit f2e2a2f

Browse files
netevertnetevert
authored
Merge pull request #47 from EbryxLabs/master
Process hollowing rule update
2 parents 3f506e2 + 3658370 commit f2e2a2f

File tree

3 files changed

+67
-37
lines changed

3 files changed

+67
-37
lines changed

‎detections/T1093_Process_Hollowing.txt

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
// Name: Process Hollowing
2+
// Description: Checks for execution of MITRE ATT&CK T1093
3+
//
4+
// Severity: High
5+
//
6+
// QueryFrequency: 1h
7+
//
8+
// QueryPeriod: 1h
9+
//
10+
// AlertTriggerThreshold: 1
11+
//
12+
// DataSource: #Sysmon
13+
//
14+
// Tactics: #Defense Evasion
15+
//
16+
Sysmon
17+
| where EventID == 1 and (
18+
(
19+
process_path contains "smss.exe" and
20+
process_parent_command_line !contains "smss.exe"
21+
) or (
22+
process_path contains "csrss.exe" and (
23+
process_parent_command_line !contains "smss.exe" and
24+
process_parent_command_line !contains "svchost.exe"
25+
)
26+
) or (
27+
process_path contains "wininit.exe"and
28+
process_parent_command_line !contains "smss.exe"
29+
) or (
30+
process_path contains "winlogon.exe" and
31+
process_parent_command_line !contains "smss.exe"
32+
) or (
33+
process_path contains "lsass.exe" and
34+
process_parent_command_line !contains "wininit.exe"
35+
) or (
36+
process_path contains "LogonUI.exe" and (
37+
process_parent_command_line !contains "winlogon.exe" and
38+
process_parent_command_line !contains "wininit.exe"
39+
)
40+
) or (
41+
process_path contains "services.exe" and
42+
process_parent_command_line !contains "wininit.exe"
43+
) or (
44+
process_path contains "spoolsv.exe" and
45+
process_parent_command_line !contains "services.exe"
46+
) or (
47+
process_path contains "taskhost.exe" and (
48+
process_parent_command_line !contains "services.exe" and
49+
process_parent_command_line !contains "svchost.exe"
50+
)
51+
) or (
52+
process_path contains "taskhostw.exe" and (
53+
process_parent_command_line !contains "services.exe" and
54+
process_parent_command_line !contains "svchost.exe"
55+
)
56+
) or (
57+
process_path contains "userinit.exe" and (
58+
process_parent_command_line !contains "dwm.exe" and
59+
process_parent_command_line !contains "winlogon.exe"
60+
)
61+
)
62+
)
63+
| extend AccountCustomEntity = UserName
64+
| extend HostCustomEntity = Computer
65+
| extend FileHashCustomEntity = hash_sha256

‎detections/T1093_Process_Holoowing.txt

Lines changed: 0 additions & 35 deletions
This file was deleted.

‎detections/sentinel_attack_rules.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -863,7 +863,7 @@
863863
"description": "Checks for execution of MITRE ATT&CK T1093",
864864
"severity": "High",
865865
"enabled": "true",
866-
"query": "Sysmon | where EventID == 1 and (process_path contains \"smss.exe\" and process_parent_command_line !contains \"smss.exe\") or (process_path contains \"csrss.exe\" and (process_parent_command_line !contains \"smss.exe\" or process_parent_command_line !contains \"svchost.exe\")) or (process_path contains \"wininit.exe\"and process_parent_command_line !contains \"smss.exe\") or (process_path contains \"winlogon.exe\" and process_parent_command_line !contains \"smss.exe\") or (process_path contains \"lsass.exe\" and process_parent_command_line !contains \"wininit.exe\") or (process_path contains \"LogonUI.exe\" and (process_parent_command_line !contains \"winlogon.exe\" or process_parent_command_line !contains \"wininit.exe\")) or (process_path contains \"services.exe\" and process_parent_command_line !contains \"wininit.exe\") or (process_path contains \"spoolsv.exe\" and process_parent_command_line !contains \"services.exe\") or (process_path contains \"taskhost.exe\" and (process_parent_command_line !contains \"services.exe\" or process_parent_command_line !contains \"svchost.exe\")) or (process_path contains \"taskhostw.exe\" and (process_parent_command_line !contains \"services.exe\" or process_parent_command_line !contains \"svchost.exe\")) or (process_path contains \"userinit.exe\" and (process_parent_command_line !contains \"dwm.exe\" or process_parent_command_line !contains \"winlogon.exe\"))",
866+
"query": "Sysmon | where EventID == 1 and ((process_path contains \"smss.exe\" and process_parent_command_line !contains \"smss.exe\") or (process_path contains \"csrss.exe\" and (process_parent_command_line !contains \"smss.exe\" and process_parent_command_line !contains \"svchost.exe\")) or (process_path contains \"wininit.exe\" and process_parent_command_line !contains \"smss.exe\") or (process_path contains \"winlogon.exe\" and process_parent_command_line !contains \"smss.exe\") or (process_path contains \"lsass.exe\" and process_parent_command_line !contains \"wininit.exe\") or (process_path contains \"LogonUI.exe\" and (process_parent_command_line !contains \"winlogon.exe\" and process_parent_command_line !contains \"wininit.exe\")) or (process_path contains \"services.exe\" and process_parent_command_line !contains \"wininit.exe\") or (process_path contains \"spoolsv.exe\" and process_parent_command_line !contains \"services.exe\") or (process_path contains \"taskhost.exe\" and (process_parent_command_line !contains \"services.exe\" and process_parent_command_line !contains \"svchost.exe\")) or (process_path contains \"taskhostw.exe\" and (process_parent_command_line !contains \"services.exe\" and process_parent_command_line !contains \"svchost.exe\")) or (process_path contains \"userinit.exe\" and (process_parent_command_line !contains \"dwm.exe\" and process_parent_command_line !contains \"winlogon.exe\"))) | extend AccountCustomEntity = UserName | extend HostCustomEntity = Computer | extend FileHashCustomEntity = hash_sha256",
867867
"queryFrequency": "1H",
868868
"queryPeriod": "1H",
869869
"triggerOperator": "GreaterThan",
@@ -1522,4 +1522,4 @@
15221522
"suppressionEnabled": "false"
15231523
}
15241524
]
1525-
}
1525+
}

0 commit comments

Comments
 (0)