From 856a946dfbcf0aaacaa1826faf97d20ae3e19392 Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Fri, 14 Aug 2020 12:47:18 +0200 Subject: [PATCH 1/8] macOS Keychains compression --- ...ration_compress_credentials_keychains.toml | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 rules/macos/exfiltration_compress_credentials_keychains.toml diff --git a/rules/macos/exfiltration_compress_credentials_keychains.toml b/rules/macos/exfiltration_compress_credentials_keychains.toml new file mode 100644 index 00000000000..47513ae9842 --- /dev/null +++ b/rules/macos/exfiltration_compress_credentials_keychains.toml @@ -0,0 +1,44 @@ +[metadata] +creation_date = "2020/08/14" +ecs_version = ["1.5.0"] +maturity = "production" +updated_date = "2020/08/14" + +[rule] +author = ["Elastic"] +description = """ +Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way +for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, +websites, secure notes, certificates, and Kerberos. +""" +index = ["auditbeat-*", "logs-endpoint.events.*"] +language = "kuery" +license = "Elastic License" +name = "Preparation of Keychain crednetials exfiltration" +references = ["https://objective-see.com/blog/blog_0x25.html"] +risk_score = 73 +rule_id = "96e90768-c3b7-4df6-b5d9-6237f8bc36a8" +severity = "high" +tags = ["Elastic", "MacOS"] +type = "query" + +query = ''' +event.category:process and event.type:(start or process_started) and + process.name:(zip or tar or gzip or hdiutil) and + process.args:("/Library/Keychains/" or "/Network/Library/Keychains/" or "~/Library/Keychains/") +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1142" +name = "Keychain" +reference = "https://attack.mitre.org/techniques/T1142/" + + +[rule.threat.tactic] +id = "TA0006" +name = "Credential Access" +reference = "https://attack.mitre.org/tactics/TA0006/" + From b91f8d772c88fbb8520281076bb2f6317f82fb1e Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Sat, 15 Aug 2020 14:14:07 +0200 Subject: [PATCH 2/8] Update exfiltration_compress_credentials_keychains.toml --- rules/macos/exfiltration_compress_credentials_keychains.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/macos/exfiltration_compress_credentials_keychains.toml b/rules/macos/exfiltration_compress_credentials_keychains.toml index 47513ae9842..9629f8948b8 100644 --- a/rules/macos/exfiltration_compress_credentials_keychains.toml +++ b/rules/macos/exfiltration_compress_credentials_keychains.toml @@ -24,7 +24,7 @@ type = "query" query = ''' event.category:process and event.type:(start or process_started) and - process.name:(zip or tar or gzip or hdiutil) and + process.name:(zip or tar or gzip or or 7za or hdiutil) and process.args:("/Library/Keychains/" or "/Network/Library/Keychains/" or "~/Library/Keychains/") ''' From 053285a3d998062f40cb364d722413e273848e22 Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Sat, 15 Aug 2020 14:16:20 +0200 Subject: [PATCH 3/8] Update exfiltration_compress_credentials_keychains.toml --- rules/macos/exfiltration_compress_credentials_keychains.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/macos/exfiltration_compress_credentials_keychains.toml b/rules/macos/exfiltration_compress_credentials_keychains.toml index 9629f8948b8..46d2c8f1c16 100644 --- a/rules/macos/exfiltration_compress_credentials_keychains.toml +++ b/rules/macos/exfiltration_compress_credentials_keychains.toml @@ -24,7 +24,7 @@ type = "query" query = ''' event.category:process and event.type:(start or process_started) and - process.name:(zip or tar or gzip or or 7za or hdiutil) and + process.name:(zip or tar or gzip or 7za or hdiutil) and process.args:("/Library/Keychains/" or "/Network/Library/Keychains/" or "~/Library/Keychains/") ''' From 0a4ac09ef4c438afe73d73073594c7e6ff9e21dd Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Thu, 20 Aug 2020 01:11:27 +0200 Subject: [PATCH 4/8] Update exfiltration_compress_credentials_keychains.toml --- rules/macos/exfiltration_compress_credentials_keychains.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/macos/exfiltration_compress_credentials_keychains.toml b/rules/macos/exfiltration_compress_credentials_keychains.toml index 46d2c8f1c16..2b5bc76e74f 100644 --- a/rules/macos/exfiltration_compress_credentials_keychains.toml +++ b/rules/macos/exfiltration_compress_credentials_keychains.toml @@ -23,7 +23,7 @@ tags = ["Elastic", "MacOS"] type = "query" query = ''' -event.category:process and event.type:(start or process_started) and +event.category:process and not event.type:end and process.name:(zip or tar or gzip or 7za or hdiutil) and process.args:("/Library/Keychains/" or "/Network/Library/Keychains/" or "~/Library/Keychains/") ''' From 926787f7ae469eeb783fa4f180f1f3372f553fae Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Fri, 4 Sep 2020 10:46:18 +0200 Subject: [PATCH 5/8] Update rules/macos/exfiltration_compress_credentials_keychains.toml Co-authored-by: Justin Ibarra --- rules/macos/exfiltration_compress_credentials_keychains.toml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/rules/macos/exfiltration_compress_credentials_keychains.toml b/rules/macos/exfiltration_compress_credentials_keychains.toml index 2b5bc76e74f..7c71d5cb0fa 100644 --- a/rules/macos/exfiltration_compress_credentials_keychains.toml +++ b/rules/macos/exfiltration_compress_credentials_keychains.toml @@ -1,6 +1,6 @@ [metadata] creation_date = "2020/08/14" -ecs_version = ["1.5.0"] +ecs_version = ["1.6.0"] maturity = "production" updated_date = "2020/08/14" @@ -41,4 +41,3 @@ reference = "https://attack.mitre.org/techniques/T1142/" id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" - From 02a791de2815c6d0d40d37d248ea993f1ad2a949 Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Fri, 4 Sep 2020 10:46:26 +0200 Subject: [PATCH 6/8] Update rules/macos/exfiltration_compress_credentials_keychains.toml Co-authored-by: Justin Ibarra --- rules/macos/exfiltration_compress_credentials_keychains.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/macos/exfiltration_compress_credentials_keychains.toml b/rules/macos/exfiltration_compress_credentials_keychains.toml index 7c71d5cb0fa..09c2b73716a 100644 --- a/rules/macos/exfiltration_compress_credentials_keychains.toml +++ b/rules/macos/exfiltration_compress_credentials_keychains.toml @@ -14,7 +14,7 @@ websites, secure notes, certificates, and Kerberos. index = ["auditbeat-*", "logs-endpoint.events.*"] language = "kuery" license = "Elastic License" -name = "Preparation of Keychain crednetials exfiltration" +name = "Compression of Keychain Credentials" references = ["https://objective-see.com/blog/blog_0x25.html"] risk_score = 73 rule_id = "96e90768-c3b7-4df6-b5d9-6237f8bc36a8" From 35aba47ef820d6a553dfa83a6b180fb25e9c6339 Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Fri, 4 Sep 2020 10:46:34 +0200 Subject: [PATCH 7/8] Update rules/macos/exfiltration_compress_credentials_keychains.toml Co-authored-by: Justin Ibarra --- rules/macos/exfiltration_compress_credentials_keychains.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/macos/exfiltration_compress_credentials_keychains.toml b/rules/macos/exfiltration_compress_credentials_keychains.toml index 09c2b73716a..6a5430271a0 100644 --- a/rules/macos/exfiltration_compress_credentials_keychains.toml +++ b/rules/macos/exfiltration_compress_credentials_keychains.toml @@ -23,7 +23,7 @@ tags = ["Elastic", "MacOS"] type = "query" query = ''' -event.category:process and not event.type:end and +event.category:process and event.type:(start or process_started) and process.name:(zip or tar or gzip or 7za or hdiutil) and process.args:("/Library/Keychains/" or "/Network/Library/Keychains/" or "~/Library/Keychains/") ''' From 1e8d31e94ad5a647f68ee4b347aa42972d583316 Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Wed, 9 Sep 2020 17:45:04 +0200 Subject: [PATCH 8/8] Update exfiltration_compress_credentials_keychains.toml --- rules/macos/exfiltration_compress_credentials_keychains.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/macos/exfiltration_compress_credentials_keychains.toml b/rules/macos/exfiltration_compress_credentials_keychains.toml index 6a5430271a0..143503dd9aa 100644 --- a/rules/macos/exfiltration_compress_credentials_keychains.toml +++ b/rules/macos/exfiltration_compress_credentials_keychains.toml @@ -14,7 +14,7 @@ websites, secure notes, certificates, and Kerberos. index = ["auditbeat-*", "logs-endpoint.events.*"] language = "kuery" license = "Elastic License" -name = "Compression of Keychain Credentials" +name = "Compression of Keychain Credentials Directories" references = ["https://objective-see.com/blog/blog_0x25.html"] risk_score = 73 rule_id = "96e90768-c3b7-4df6-b5d9-6237f8bc36a8"