Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detection Resources and Other Updates #179

Merged
merged 8 commits into from
Nov 15, 2021
Merged

Detection Resources and Other Updates #179

merged 8 commits into from
Nov 15, 2021

Conversation

bohops
Copy link
Contributor

@bohops bohops commented Nov 13, 2021

This PR primarily adds content for addressing detection info for LOLBINs (e.g. those available). The following has been added:

  • Sigma/Elastic/Splunk fields - Relevant rules were linked to the GitHub projects that likely applied to the LOLBIN characteristics. There may be other relevant rules that can always be added. For some LOLBINs, a blank 'Sigma' field was added as a placeholder for a future community rule link.
  • IOC field - This is the original field that was included in LOLBAS under Detection. The field is relevant if contextual information is provided. In this PR, IOC fields were updated, added, or removed (if irrelevant).
  • BlockRule field - If a lolbin is explicitly mentioned in the WDAC Block Rules, there is a link to the resource.
  • Analysis field - This is an experimental field that was added to a single lolbin. Ideally, this will link to a resource (e.g. blog post) that provides insight into a particular detection (engineering) technique/methodology/etc.

Additionally, several content updates were creates that included the following:

  • General syntax/quality updates were fixed throughout (e.g. code fields)
  • dfshim.dll was added to oslibraries. The content of dfsvc.exe was copied with minor updates.
  • sc.exe was updated to reflect service modification tradecraft.
  • Other subcommand descriptions/additions

Copy link
Member

@wietze wietze left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Amazing work @bohops !

I've spot checked many of your additions, trying to find any mistakes, but was unable to find any.
With some python magic I have been able to confirm all URLs you added are valid, correct and working, and no keys other than Analysis, Sigma, Elastic, Splunk, BlockRule or IOC have been used. ✅

@wietze
Copy link
Member

wietze commented Nov 14, 2021

Let's merge LOLBAS-Project/LOLBAS-Project.github.io#6 before merging this PR, to ensure the website won't break.

@bohops
Copy link
Contributor Author

bohops commented Nov 15, 2021

Thank you for reviewing @wietze! The other PR merged, so let's see how this goes :)

@bohops bohops merged commit 23dd023 into LOLBAS-Project:master Nov 15, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Improve Detection field
2 participants