-
Notifications
You must be signed in to change notification settings - Fork 22
/
0332-credential_access_rules.xml
109 lines (93 loc) · 3.86 KB
/
0332-credential_access_rules.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
<group name="credential_access,MITRE,">
<rule id="255103" level="8">
<if_group>sysmon_event1</if_group>
<field name="win.eventdata.image">\\findstr.exe</field>
<regex>cpassword</regex>
<description>Finding Passwords in SYSVOL & Exploiting Group Policy Preferences : MITRE ATT&CK T1081 - https://adsecurity.org/?p=2288</description>
<group>MITRE,attack.t1081,</group>
</rule>
<rule id="255104" level="10">
<if_sid>255547</if_sid>
<regex>HKLM\\System\\CurrentControlSet\\Control\\Lsa\\LMCompatibilityLevel</regex>
<description>ATT&CK T1075: Edit to registry key potentially downgrading NTLM authentication, potential Internal Monologue attack https://github.com/eladshamir/Internal-Monologue</description>
<group>MITRE,attack.t1075</group>
</rule>
<rule id="255105" level="10">
<if_sid>255547</if_sid>
<regex>HKLM\\System\\CurrentControlSet\\Control\\Lsa\\MSV1_0\\RestrictSendingNTLMTraffic</regex>
<description>ATT&CK T1075: Edit to registry key potentially downgrading NTLM authentication, potential Internal Monologue attack https://github.com/eladshamir/Internal-Monologue</description>
<group>MITRE,attack.t1075</group>
</rule>
<rule id="255106" level="10">
<if_group>sysmon_event_11</if_group>
<regex>\\Temp\\debug.bin</regex>
<description>Detects possible SafetyKatz Behaviour</description>
<group>MITRE,attack.t1003,sigma</group>
</rule>
<rule id="255107" level="12">
<if_group>sysmon_event_10</if_group>
<match>lsass.exe</match>
<regex>dbgcore</regex>
<description>ATT&CK T1003: dbgcore.DLL potentially used to dump credentials from LSASS</description>
<group>MITRE,attack.t1003</group>
</rule>
<rule id="255108" level="12">
<if_group>sysmon_event_13</if_group>
<field name="win.eventdata.targetObject">\\WDigest\\UseLogonCredential</field>
<description>ATT&CK T1003: Detects possible Mimikatz Activity, registry edit for WDigest plain text credentials</description>
<group>MITRE,attack.t1003,</group>
</rule>
<rule id="255109" level="0">
<if_sid>255107</if_sid>
<field name="win.eventdata.image">\\MsMpEng.exe|\\ossec-agent.exe|\\wininit.exe|\\csrss.exe</field>
<description>Whitelist Interaction with LSASS</description>
<group>MITRE,attack.t1003,</group>
</rule>
<rule id="255110" level="12">
<if_group>windows_application</if_group>
<regex>grabber_temp</regex>
<description>Microsoft Internet Explorer Passwords dumped, TTP indicative of Trickbot infection</description>
<group>MITRE,attack.t1003</group>
</rule>
<rule id="255111" level="12">
<if_sid>255531</if_sid>
<match>comsvcs.dll</match>
<regex>MiniDump|#24</regex>
<description>Comsvcs.dll potentially used to dump credentials from LSASS</description>
<group>MITRE,attack.t1003</group>
</rule>
<rule id="255112" level="12">
<if_sid>255524</if_sid>
<match>comsvcs.dll</match>
<regex>MiniDump|#24</regex>
<description>Comsvcs.dll potentially used to dump credentials from LSASS</description>
<group>MITRE,attack.t1003</group>
</rule>
<rule id="255113" level="12">
<if_sid>255524</if_sid>
<match>comsvcs.dll</match>
<regex>MiniDump|#24</regex>
<description>Comsvcs.dll potentially used to dump credentials from LSASS</description>
<group>MITRE,attack.t1003</group>
</rule>
<rule id="255114" level="12">
<if_group>sysmon_event1</if_group>
<match>mimikatz</match>
<description>Mimikatz potentially used to dump credentials from LSASS</description>
<group>MITRE,attack.t1003</group>
</rule>
<rule id="255115" level="12">
<if_group>sysmon_event1</if_group>
<match>procdump</match>
<regex>lsass</regex>
<description>Procdump potentially used to dump credentials from LSASS</description>
<group>MITRE,attack.t1003</group>
</rule>
<rule id="255116" level="12">
<if_group>sysmon_event_10</if_group>
<match>lsass.exe</match>
<regex>dbgcore</regex>
<description>dbgcore.DLL potentially used to dump credentials from LSASS</description>
<group>MITRE,attack.t1003</group>
</rule>
</group>