Примеры поддерживаемых конвертаций правил Sigma
Поддерживаемые примеры конвертации правил Sigma
Правило Sigma | Сопоставление с объектами OSMP | Условие |
|---|---|---|
title: Generic-DCSync Execution id: 9107f781-c984-436a-8093-1aaa64c70c49 description: Detects access to DC with "DS-Replication-Get-Changes" or "DS-Replication-Get-Changes-All" rights author: Kaspersky status: stable modified: 2023-08-02 tags: - attack.credential_access - attack.t1003.006 logsource: product: windows service: security detection: selection1: EventID: 4662 Properties|contains: - 'DS-Replication-Get-Changes' - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' selection2: EventID: 4624 LogonType: 3 filter: EventID: 4624 LogonType: 3 SourceIP: - '<ip address of DC servers>' timeframe: 1m condition: selection1 or (selection2 and not filter) | count(EventID) by Computer,LogonID = 2 fields: - SourceIP - Computer - LogonID - Username - Properties falsepositives: - Unknown level: high | Нормализатор "Microsoft products" tags → description logsource DeviceVendor = Microsoft
DeviceProduct = Windows
selection1:
DeviceEventClassID=4662 FilePermission contains '' OR FilePermission contains '' OR FilePermission contains '' selection2 DeviceEventClassID=4624 DeviceCustomNumber1 = 3 filter DeviceEventClassID=4624 DeviceCustomNumber1 = 3 SourceAddress = <IP> condition: DeviceVendor = Microsoft AND
DeviceProduct = Windows AND
(( DeviceEventClassID=4662 FilePermission contains '' OR FilePermission contains '' OR FilePermission contains '' ) OR ( ( DeviceEventClassID=4624 AND DeviceCustomNumber1 = 3 ) NOT ( DeviceEventClassID=4624 AND DeviceCustomNumber1 = 3 AND SourceAddress = <IP> ) ) )
все, что внутри Count() EventID положить в Unique fields, все, что после 'by' Computer → DestinationHostName LogonID → FlexString1 положить в Aggregation fields, все, что после '=' или '>' 2 положить в threshold. timeframe положить в time window | Это корреляционное правило с корреляциями, т.е. не simple правило OSMP. В данный момент поддерживается частично: если убрать пайп из правила Sigma в condition, можно получить условие селектора для корреляционного правила или SQL-запрос для Поиска угроз.
|
title: Lsass Dump via LOLBin id: 2fe9cd33-d7f1-4d52-ab11-e40cb359ad02 description: detects lsass dump via lolbins such as procdump.exe, dotnet-dump.exe, dumpminitool.exe references: - https://twitter.com/bohops/status/1635288066909966338 - https://twitter.com/mrd0x/status/1511415432888131586 modified: 2023-07-18 author: Kaspersky status: stable tags: - attack.credential_access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_procdump: Image|endswith: - '\procdump.exe' - '\procdump64.exe' CommandLine|contains: 'lsass' selection_dotnet: Image|endswith: '\dotnet-dump.exe' CommandLine: ' collect ' selection_dumpminitool: Image|endswith: '\dumpminitool.exe' condition: 1 of selection* falsepositives: - Unknown level: high | Конвертируется так же, как и правило в строке 3 таблицы. Отличие: условие в condition 1 of selection* - одна из именованных коллекций. | DeviceVendor='Microsoft' AND
DeviceProduct='Windows' AND
DeviceEventClassID='4688' AND
(
(
(DestinationProcessName endsWith '\\procdump.exe' OR
DestinationProcessName endsWith '\\procdump64.exe') AND
DeviceCustomString contains 'lsass'
) OR
(DestinationProcessName endsWith '\\dotnet-dump.exe' AND
DeviceCustomString=' collect '
) OR
DestinationProcessName endsWith '\\dumpminitool.exe'
) |
title: Generic-Clearing Windows Event Logs via Command Line id: a903492e-da40-4ab4-a92d-306a4799d973 description: Detects Clear Windows Event Logs via Command Line author: Kaspersky status: stable modified: 2023-07-18 tags: - attack.defense_evasion - attack.t1070.001 logsource: product: windows category: process_creation detection: selection1: Image|endswith: '\wevtutil.exe' CommandLine|contains: - ' cl ' - 'clear' selection2: Image|endswith: - '\powershell.exe' - '\powershell_ise.exe' - '\pwsh.exe' CommandLine|contains: - 'Clear-EventLog' - 'Remove-EventLog' selection3: Image|endswith: '\wmic.exe' CommandLine|contains: - 'ClearEventLog' condition: 1 of them falsepositives: - Legitimate System Administrator actions level: high | Нормализатор "Microsoft products" tags → description logsource DeviceVendor = Microsoft
DeviceProduct = Windows
DeviceEventClassID=4688 selection1:
DestinationProcessName endswith '' DeviceCustomString4 contains "" OR DeviceCustomString4 contains "" Selection2 DestinationProcessName endswith '' DeviceCustomString4 contains "" OR DeviceCustomString4 contains "" selection3 DestinationProcessName endswith '' DeviceCustomString4 contains "" OR DeviceCustomString4 contains "" condition DeviceVendor = Microsoft AND
DeviceProduct = Windows AND
DeviceEventClassID=4688 AND ( ( DestinationProcessName endswith '' AND (DeviceCustomString4 contains "" OR DeviceCustomString4 contains "")) OR ( DestinationProcessName endswith '' AND (DeviceCustomString4 contains "" OR DeviceCustomString4 contains "")) OR ( DestinationProcessName endswith '' AND (DeviceCustomString4 contains "" OR DeviceCustomString4 contains "")) ) identical fields - указывать поля из условия за исключением полей Name, deviceProduct, deviceVendor | DeviceVendor='Microsoft' AND
DeviceProduct='Windows' AND
DeviceEventClassID='4688' AND
(
(DestinationProcessName endsWith '\\wevtutil.exe' AND
(DeviceCustomString contains ' cl ' OR DeviceCustomString contains 'clear')
) OR
(
(DestinationProcessName endsWith '\\powershell.exe' OR
DestinationProcessName endsWith '\\powershell\_ise.exe' OR
DestinationProcessName endsWith '\\pwsh.exe') AND
(DeviceCustomString contains 'Clear-EventLog' OR
DeviceCustomString contains 'Remove-EventLog')
) OR
(DestinationProcessName endsWith '\\wmic.exe' AND
DeviceCustomString contains 'ClearEventLog')
) |
title: 0021-0002.1204.003 Execution - PowerExchangeDropper description: Detect the dropping of PowerExchange components. status: experimental logsource: product: windows service: Sysmon detection: selection1: EventID: 11 selection2: TargetFilename|contains: - 'c:\users\public\microsoftedge\autosave.exe' - 'c:\users\public\microsoftedge\wsdl.ps1' selection3: Image|endswith: "brochure.exe" condition: selection1 and selection2 and selection3 falsepositives: - Unknown level: high | Основание: Нормализатор 11 события Sysmon. title → name author → description description→ description status → description logsource DeviceVendor = Microsoft
DeviceProduct = Sysmon
selection1 DeviceEventClassID=11 selection2 FilePath contains 'c:\users\public\microsoftedge\autosave.exe' OR FilePath contains ''
если есть * пути к файлу форматировать в regexp selection3 OldFilePath endswith "" condition: DeviceVendor = Microsoft AND
DeviceProduct = Sysmon AND
(DeviceEventClassID=11) AND (FilePath contains 'c:\users\public\microsoftedge\autosave.exe' OR FilePath contains '') AND (OldFilePath endswith "") identical fields – указывать поля из условия за исключением полей Name, deviceProduct, deviceVendor level →severity falsepositive → Description | DeviceVendor='Microsoft' AND
DeviceProduct='Sysmon' AND
DeviceEventClassID=11 AND
(
FilePath contains 'c:\\users\\public\\microsoftedge\\autosave.exe' OR
FilePath contains 'c:\\users\\public\\microsoftedge\\wsdl.ps1'
) AND
OldFilePath endsWith 'brochure.exe' |
title: Domain joined host discovery description: Detect an attacker enumerating domain-joined machines using PowerShell. status: stable logsource: product: windows service: security detection: selection: EventID: 4104 ScriptBlockText|contains|all: - 'System.DirectoryServices.DirectorySearcher' - 'Properties.operatingsystem' condition: selection falsepositives: - "Administrative scripts or tools like Vulnerability Scanners" level: medium | ScriptBlockText → Message |
|
title: 0022-0002.1053.005 Execution - PowerExchange Task description: Detect the creation of a scheduled task by PowerExchange. status: experimental logsource: product: windows service: security detection: selection: EventID: - '4698' TaskName|contains: - 'MicrosoftEdgeUpdateService' condition: selection falsepositives: - Unknown level: medium | TaskName → SourceProcessName |
|
title: Created Windows Shell from Critical Windows Process description: Anomaly behavior critical windows process status: stable modified: 2023-07-18 tags: - attack.defense_evasion - attack.t1036 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: - '\searchindexer.exe' - '\lsaiso.exe' - '\lsm.exe' - '\spoolsv.exe' - '\wininit.exe' - '\smss.exe' - '\csrss.exe' - '\lsass.exe' - '\services.exe' - '\winlogon.exe' Image|endswith: - '\powershell_ise.exe' - '\cmstp.exe' - '\appvlp.exe' - '\mftrace.exe' - '\scriptrunner.exe' - '\forfiles.exe' - '\msiexec.exe' - '\rundll32.exe' - '\mshta.exe' - '\hh.exe' - '\wmic.exe' - '\regsvr32.exe' - '\scrcons.exe' - '\bash.exe' - '\sh.exe' - '\cscript.exe' - '\wscript.exe' - '\powershell.exe' - '\cmd.exe' condition: selection falsepositives: - Unknown level: high | ParentImage → SourceProcessName |
|
